2022/0272(COD) | [ParlTrack]

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Recital 35

(35) Manufacturers should also report to ENISA any incident having an impact on the security of the product with digital elements. Notwithstanding the incident reporting obligations in Directive [Directive XXX/XXXX (NIS2)] for essential and important entities, it is crucial for ENISA, the single points of contact designated by the Member States relevant CSIRTs or, where applicable the relevant market surveillance authority, any incident having a~~ccordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] and the market surveillance authorities to receive information from the manufacturers of~~ significant impact on the security of the products with digital elements ~~allowing them to assess the security of these products~~. In order to ensure that users can react quickly to incidents having an significant impact on the security of their products with digital elements, manufacturers should also inform their users about any such incident and, where applicable, about any corrective measures that the users can deploy to mitigate the impact of the incident, for example by publishing relevant information on their websites or, where the manufacturer is able to contact the users and where justified by the risks, by reaching out to the users directly.

Amendment 101 #

Proposal for a regulation
Recital 38

(38) In order to facilitate assessment of conformity with the requirements laid down by this Regulation, there should be a presumption of conformity for products with digital elements which are in conformity with harmonised standards, which translate the essential requirements of this Regulation into detailed technical specifications, and which are adopted in accordance with Regulation (EU) No 1025/2012 of the European Parliament and of the Council29 . Regulation (EU) No 1025/2012 provides for a procedure for objections to harmonised standards where those standards do not entirely satisfy the requirements of this Regulation. The standardisation process should ensure a balanced representation of interests and effective participation of civil society stakeholders, including consumer organisations. __________________ 29 Regulation (EU) No 1025/2012 of the European Parliament and of the Council of 25 October 2012 on European standardisation, amending Council Directives 89/686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of the European Parliament and of the Council and repealing Council Decision 87/95/EEC and Decision No 1673/2006/EC of the European Parliament and of the Council (OJ L 316, 14.11.2012, p. 12).

Amendment 102 #

Proposal for a regulation
Recital 45

(45) As a general rule the requirements for the conformity assessment of products with digital elements should be risk-based and to that regard in many cases the assessment could be carried out by the manufacturer under its own responsibility following the procedure based on Module A of Decision 768/2008/EC. The manufacturer should retain flexibility to choose a stricter conformity assessment procedure involving a third-party. If the product is classified as a critical product of class I, additional assurance is required to demonstrate conformity with the essential requirements set out in this Regulation. The manufacturer should apply harmonised standards, common specifications or cybersecurity certification schemes under Regulation (EU) 2019/881 which have been identified by the Commission in an implementing act, if it wants to carry out the conformity assessment under its own responsibility (module A). If the manufacturer does not apply such harmonised standards, common specifications or cybersecurity certification schemes, the manufacturer should undergo conformity assessment involving a third party. Taking into account the administrative burden on manufacturers and the fact that cybersecurity plays an important role in the design and development phase of tangible and intangible products with digital elements, conformity assessment procedures respectively based on modules B+C or module H of Decision 768/2008/EC have been chosen as most appropriate for assessing the compliance of critical products with digital elements in a proportionate and effective manner. The manufacturer that carries out the third- party conformity assessment can choose the procedure that suits best its design and production process. Given the even greater cybersecurity risk linked with the use of products classified as critical class II products, the conformity assessment should always involve a third party.

Amendment 103 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Recital 45

(45) As a general rule the conformity assessment of products with digital elements should be carried out by the manufacturer under its own responsibility following the procedure based on Module A of Decision 768/2008/EC. The manufacturer should retain flexibility to choose a stricter conformity assessment procedure involving a third-party. If the product is classified as a critical product of class I, additional assurance is required to demonstrate conformity with the essential requirements set out in this Regulation. The manufacturer should apply harmonised standards~~, common specifications~~ or cybersecurity certification schemes under Regulation (EU) 2019/881 which have been identified by the Commission in an implementing act, if it wants to carry out the conformity assessment under its own responsibility (module A). If the manufacturer does not apply such harmonised standards~~, common specifications~~ or cybersecurity certification schemes, the manufacturer should undergo conformity assessment involving a third party. Taking into account the administrative burden on manufacturers and the fact that cybersecurity plays an important role in the design and development phase of tangible and intangible products with digital elements, conformity assessment procedures respectively based on modules B+C or module H of Decision 768/2008/EC have been chosen as most appropriate for assessing the compliance of critical products with digital elements in a proportionate and effective manner. The manufacturer that carries out the third- party conformity assessment can choose the procedure that suits best its design and production process. Given the even greater cybersecurity risk linked with the use of products classified as critical class II products, the conformity assessment should always involve a third party.

Amendment 104 #

Proposal for a regulation
Recital 56 a (new)

(56 a) In order for SMEs to be able to cope with the new obligations imposed by this Regulation, the Commission should provide them with relevant guidelines.

Amendment 105 #

Proposal for a regulation
Recital 62

(62) In order to ensure that the regulatory framework can be adapted where necessary, the power to adopt acts in accordance with Article 290 of the Treaty should be delegated to the Commission in respect of updates to the list of critical products in Annex III and specifying the definitions of the these product categories. Power to adopt acts in accordance with that Article should be delegated to the Commission to identify products with digital elements covered by other Union rules which achieve the same level of protection as this Regulation, specifying whether a limitation or exclusion from the scope of this Regulation would be necessary as well as the scope of that limitation, if applicable. Power to adopt acts in accordance with that Article should also be delegated to the Commission in respect of the potential ~~mandating of~~voluntary certification of certain highly critical products with digital elements based on criticality crieria set out in this Regulation, as well as for specifying the minimum content of the EU declaration of conformity and supplementing the elements to be included in the technical documentation. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making 33 . In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. __________________ 33 OJ L 123, 12.5.2016, p. 1.

Amendment 106 #

Proposal for a regulation
Recital 63

(63) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission to: specify the format and elements of the software bill of materials, specify further the type of information, format and procedure of the notifications on actively exploited vulnerabilities and incidents submitted to ENISA by the manufacturers, based on industry best practices, specify the European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 that can be used to demonstrate conformity with the essential requirements or parts therefore as set out in Annex I of this Regulation, adopt common specifications in respect of the essential requirements set out in Annex I, lay down technical specifications for pictograms or any other marks related to the security of the products with digital elements, and mechanisms to promote their use, decide on corrective or restrictive measures at Union level in exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council34 . __________________ 34 Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p.13).

Amendment 107 #

Proposal for a regulation
Recital 69

(69) Economic operators should be provided with a sufficient time to adapt to the requirements of this Regulation. This Regulation should apply [124 months] from its entry into force~~, with the exception of the reporting obligations concerning actively exploited vulnerabilities and incidents, which should apply [12 months] from the entry into force of this Regulation~~.

Amendment 108 #

Proposal for a regulation
Recital 69

(69) Economic operators should be provided with a sufficient time to adapt to the requirements of this Regulation. This Regulation should apply [248 months] from its entry into force, with the exception of the reporting obligations concerning ~~actively~~known exploited vulnerabilities and significant incidents, which should apply [124 months] from the entry into force of this Regulation.

Amendment 109 #

Proposal for a regulation
Recital 71 a (new)

(71 a) The Commission shall present easy-to-understand guidelines for businesses with the requirements of this Regulation. When developing such guidelines, the Commission should take into consideration needs of SMEs so as to keep administrative and financial burdens to a minimum while facilitating their compliance with this Regulation. The Commission should consult relevant stakeholders, with expertise in the field of cybersecurity.

Amendment 110 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Recital 71 b (new)

(71 b) Where third party assessment is mandated, such assessment should take into account: the similarity of products with digital elements by accepting one product as representative of a family or category of products for assessment purposes due to them having equitable hardware and/or software; reciprocity to eliminate duplication by accepting of other entities’ assessments or certification (e.g. recognition of assessments from qualified bodies outside the Union; reuse of certifications); deltas in order to only focus on additional requirements not covered by other entities’ assessments and not reassessing the whole set; attestation in order to accept assessments from the manufacturer for certain aspects of the wider third-party assessment; and maintenance to allow certain changes or software updates to the product without requiring reassessment. In particular, software updates that do not weaken the security posture of the product should not be considered as justifiable to require reassessment.

Amendment 111 #

Proposal for a regulation
Article 1 – paragraph 1 – introductory part

The objective of this Regulation is to provide for a high level of consumer protection by protecting the confidentiality, integrity and availability of information in products with digital elements. This Regulation lays down:

Amendment 112 #

Proposal for a regulation
Article 1 – paragraph 1 – point d

(d) rules on market monitoring, market surveillance and enforcement of the above- mentioned rules and requirements.

Amendment 113 #

Proposal for a regulation
Article 2 – paragraph 1

1. This Regulation applies to products with digital elements placed on the market whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a ~~device or~~ network.

Amendment 114 #

Proposal for a regulation
Article 2 – paragraph 1

Amendment 115 #

Proposal for a regulation
Article 2 – paragraph 2 – point c a (new)

(c a) Regulation (EU) 2022/2554;

Amendment 116 #

Proposal for a regulation
Article 2 – paragraph 2 – point c b (new)

(c b) Directive (EU) 2022/2555.

Amendment 117 #

Proposal for a regulation
Article 2 – paragraph 3 a (new)

3 a. This Regulation shall not apply to software provided under free and open- source licences, including its source code and modified versions, except when such software is provided as a paid or monetised product. The compliance of free and open-source components of products shall be ensured by the manufacturer of the product.

Amendment 118 #

Proposal for a regulation
Article 2 – paragraph 4 – subparagraph 2

~~The Commission is empowered to adopt~~ delegated acts in accordance with Article 50 to amend this Regulation specifying whether such limitation or exclusion is necessary, the concerned products and rules, as well as the scope of the limitation, if relevant.

Amendment 119 #

Proposal for a regulation
Article 2 – paragraph 5 – subparagraph 1 (new)

6. This Regulation does not apply to the internal networks of a product with digital elements if these networks have dedicated endpoints and are secured from external data connection.

Amendment 120 #

Proposal for a regulation
Article 2 – paragraph 5 a (new)

5 a. This Regulation does not apply to freeware and open-source software unless: (a) the developer or a third-party has agreed to the provision of technical support services, either with a user, or with a manufacturer who wishes to use the software as a component in their own products. (b) the software is provided in the course of commercial activity, either by: (i) charging a price for a product; (ii) providing a software platform reliant on other services which the manufacturer monetises; (iii) using personal data generated by the software for reasons other than exclusively for improving the security, compatibility or interoperability of the software.

Amendment 121 #

Proposal for a regulation
Article 2 – paragraph 5 a (new)

5 a. This Regulation does not apply to any supply of a product with digital elements for distribution and use on the Union market where such supply, distribution, and use exclusively occurs within the same group of companies within the meaning of Article 2(13) of Regulation (EU) 2015/848.

Amendment 122 #

Proposal for a regulation
Article 2 – paragraph 5 a (new)

5 a. This Regulation shall not apply to spare parts intended solely to replace defective parts of products with digital elements, in order to restore their functionality.

Amendment 123 #

Proposal for a regulation
Article 3 – paragraph 1 – point 1

(1) ‘product with digital elements’ means any software or hardware product ~~and its~~its ancillary services, including remote data processing solutions, ~~including~~and software or hardware components to be placed on the market separately;

Amendment 124 #

Proposal for a regulation
Article 3 – paragraph 1 – point 1

(1) ‘product with digital elements’ means any software or hardware product ~~and its remote data processing solutions~~, including software or hardware components to be placed on the market separately;

Amendment 125 #

Proposal for a regulation
Article 3 – paragraph 1 – point 1 a (new)

(1 a) 'partly completed products with digital elements’ means an assembly which cannot in itself function so as to perform a specific application and which is only intended to be incorporated into or assembled with a product with digital elements or other partly completed product with digital elements, thereby forming a product with digital elements;

Amendment 126 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 3 – paragraph 1 – point 2

(2) ‘remote data processing’ means any data processing at a distance for which the software is designed and developed by the manufacturer or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its functions;deleted

Amendment 127 #

Proposal for a regulation
Article 3 – paragraph 1 – point 4 a (new)

(4 a) ‘consumer’ means any natural person who, under the circumstances regulated by this Regulation, is acting for purposes which are outside their trade, business, craft or profession;

Amendment 128 #

Proposal for a regulation
Article 3 – paragraph 1 – point 6

(6) ‘software’ means the part of an electronic information system which consists of computer code, with exception of software relating to the Internet websites;

Amendment 129 #

Proposal for a regulation
Article 3 – paragraph 1 – point 6 a (new)

(6 a) 'freeware' means proprietary software that is provided at no cost to the user, but cannot be distributed, studied, changed, improved, integrated into other products or provided as a service without the consent of the author;

Amendment 130 #

Proposal for a regulation
Article 3 – paragraph 1 – point 6 b (new)

(6 b) ‘ open-source software’ means software distributed under a licence which allow users to run, copy, distribute, study, change and improve it freely, as well as to integrate it as a component in other products, provide it as a service, or provide commercial support for it;

Amendment 131 #

Proposal for a regulation
Article 3 – paragraph 1 – point 11

(11) ‘physical connection’ means any connection between electronic information systems or components implemented using physical means, including through electrical or mechanical interfaces~~, wires or radio wav~~ or wires;

Amendment 132 #

Proposal for a regulation
Article 3 – paragraph 1 – point 18

(18) ‘manufacturer’ means any natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under his or her name or trademark, whether for payment or ~~free of charge~~monetisation;

Amendment 133 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 3 – paragraph 1 – point 23

(23) ‘making available on the market’ means any supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, ~~whether~~and in return for payment ~~or free of charge~~;

Amendment 134 #

Proposal for a regulation
Article 3 – paragraph 1 – point 23 a (new)

(23 a) ‘recall’ means recall as defined in Article 3, point (22) of Regulation (EU) 2019/1020;

Amendment 135 #

Proposal for a regulation
Article 3 – paragraph 1 – point 26

(26) ‘reasonably foreseeable misuse’ means the use of a product with digital elements in a way that is not in accordance with its intended purpose, but which may result from reasonably foreseeable human behaviour or interaction with other systems;deleted (This amendment applies throughout the text.)

Amendment 136 #

Proposal for a regulation
Article 3 – paragraph 1 – point 31

(31) ‘substantial modification’ means a change to the product with digital elements following its placing on the market, which ~~affects the compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I or results in a modification to the intended use for which~~has material impact on the core function of the product with digital elements ~~has been assessed~~;

Amendment 137 #

Proposal for a regulation
Article 3 – paragraph 1 – point 31

(31) ‘substantial modification’ means a change to the product with digital elements, excluding security and maintenance updates, following its placing on the market, which affects the compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I or results in a modification to the intended use for which the product with digital elements has been assessed;

Amendment 138 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN

Proposal for a regulation
Article 3 – paragraph 1 – point 39

(39) ‘actively exploited vulnerability’ means a patched vulnerability for which there is reliable evidence that execution of malicious code was performed by an actor on a system without permission of the system owner;

Amendment 139 #

Proposal for a regulation
Article 3 – paragraph 1 – point 40 a (new)

(40 a) 'partly completed products with digital elements' means a tangible item which is unable to function independently and which is only produced with the aim of be incorporated into or assembled with a product with digital elements or other partly completed product with digital elements, and which can only be effectively assessed for its conformity taking into account how it is incorporated into an intended final product with digital elements;

Amendment 140 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN

Proposal for a regulation
Article 3 – paragraph 1 – point 40 a (new)

(40 a) ‘life-cycle’ means the period from the moment that product covered by this Regulation is placed on the market or put into service until the moment that it is discarded, including the effective time when it is capable of being used and the phases of transport, assembly, dismantling, disabling, scrapping or other physical or digital modifications foreseen by the manufacturer;

Amendment 141 #

Proposal for a regulation
Article 4 – paragraph 1

1. Member States shall not impede, for the matters covered by this Regulation, the making available on the market of products with digital elements or partly completed products with digital elements which comply with this Regulation.

Amendment 142 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 4 – paragraph 1

Amendment 143 #

Proposal for a regulation
Article 4 – paragraph 2

2. At trade fairs, exhibitions and demonstrations or similar events, Member States shall not prevent the presentation and use of a product with digital elements which does not comply with this Regulation provided that the product is used exclusively for exhibition purposes within the course of such event and that a visible sign clearly indicates that it does not comply with this Regulation.

Amendment 144 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN

Proposal for a regulation
Article 4 – paragraph 2

2. ~~At trade fairs, exhibitions and demonstrations or similar events,~~ Member States shall not prevent the presentation and use of a prototype product with digital elements or a software, which does not comply with this Regulation, provided that the availability is limited in time and geographical area and is supplied exclusively for testing.

Amendment 145 #

Proposal for a regulation
Article 4 – paragraph 2

2. At trade fairs, exhibitions and demonstrations or similar events, Member States shall not prevent the presentation and use of a product with digital elements or a partly completed product with digital elements which does not comply with this Regulation.

Amendment 146 #

Proposal for a regulation
Article 4 – paragraph 2

2. At trade fairs, exhibitions and demonstrations or similar events, Member States shall not prevent the presentation and use of a product with digital elements or partly completed products with digital elements which does not comply with this Regulation.

Amendment 147 #

Proposal for a regulation
Article 4 – paragraph 3

3. Member States shall not prevent the making available of unfinished software which does not comply with this Regulation provided that the software is only made available for a limited period required for testing purposes and that a visible sign clearly indicates that it does not comply with this Regulation and will not be available on the market for purposes other than testing.deleted

Amendment 148 #

Proposal for a regulation
Article 4 – paragraph 3

3. Member States shall not prevent the making available of unfinished software which does not comply with this Regulation provided that the software is only made available ~~for a limited period required for testing purposes~~in a non-production version for testing purposes, including software labelled as ‘beta,’ ‘pre-release’, or ‘candidate’, and that a visible sign clearly indicates that it does not comply with this Regulation and will not be available on the market for purposes other than testing.

Amendment 149 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 5 – paragraph 1 – point 1

(1) they meet the essential requirements set out in Section 1 of Annex I, under the condition that they are properly installed, maintained, used for their intended purpose or under conditions which can reasonably be foreseen, and~~, where applicable,~~ provided with the necessary security and functionality updateds, and

Amendment 150 #

Proposal for a regulation
Article 5 – paragraph 1 – point 1

(1) they meet the essential requirements set out in Section 1 of Annex I, under the condition that they are properly installed, maintained, used for their intended purpose or under conditions which can reasonably be foreseen, ~~and, where applicable,~~provided with the necessary security and functionality updateds, and

Amendment 151 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN

Proposal for a regulation
Article 6 – paragraph 2 – introductory part

2. The Commission is empowered to adopt delegated acts in accordance with Article 50 to amend Annex III by including in the list of categories of critical products with digital elements a new category or withdrawing an existing one from that list 48 months after the start of application of this Regulation and every 5 years thereafter. When assessing the need to amend the list in Annex III, the Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements. In determining the level of cybersecurity risk, one or several of the following criteria shall be taken into account:

Amendment 152 #

Proposal for a regulation
Article 6 – paragraph 2 – point b

(b) the intended use in ~~sensitive environments, including in industrial setting~~critical applications in sensitive environments or by essential entities of the type referred to in the Annex [Annex I] to the Directive [Directive XXX/XXXX (NIS2)];

Amendment 153 #

Proposal for a regulation
Article 6 – paragraph 2 – point c

(c) the intended use and scale of performing critical or sensitive functions, such as the volume of processing of personal data;

Amendment 154 #

Proposal for a regulation
Article 6 – paragraph 3

~~3. The Commission is empowered to adopt a~~ delegated act in accordance with Article 50 to supplement this Regulation by specifying the definitions of the product categories under class I and class II as set out in Annex III. The delegated act shall be adopted [by 12 months since the entry into force of this Regulation].

Amendment 155 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 6 – paragraph 3

Amendment 156 #

Proposal for a regulation
Article 6 – paragraph 3

Amendment 157 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI

Proposal for a regulation
Article 6 – paragraph 4

4. Critical products with digital elements shall be subject to the conformity assessment procedures referred to in Article 24(2) and (3). By exception, small and micro enterprises can use the procedure referred to in Article 24(2).

Amendment 158 #

Proposal for a regulation
Article 6 – paragraph 4

4. Critical products with digital elements shall be subject to the conformity assessment procedures referred to in Article 24~~(2) and~~ (3).

Amendment 159 #

Proposal for a regulation
Article 6 – paragraph 5

~~5. The Commission is empowered to adopt~~ delegated acts in accordance with Article 50 to supplement this Regulation by specifying categories of highly critical products with digital elements for which the manufacturers shall be required to obtain a European cybersecurity certificate under a European cybersecurity certification scheme pursuant to Regulation (EU) 2019/881 to demonstrate conformity with the essential requirements set out in Annex I, or parts thereof. When determining such categories of highly critical products with digital elements, the Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements, in light of one or several of the criteria listed in paragraph 2, as well as in view of the assessment of whether that category of products is: (a) essential entities of the type referred to in Annex [Annex I] to the Directive [Directive XXX/ XXXX (NIS2)] or will have potential future significance for the activities of these entities; or (b) overall supply chain of products with digital elements against disruptive events.used or relied upon by the relevant for the resilience of the

Amendment 160 #

Proposal for a regulation
Article 6 – paragraph 5 – introductory part

5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by specifying categories of highly critical products with digital elements for which the manufacturers ~~shall be required to~~may obtain a European cybersecurity certificate under a European cybersecurity certification scheme pursuant to Regulation (EU) 2019/881 to demonstrate conformity with the essential requirements set out in Annex I, or parts thereof. When determining such categories of highly critical products with digital elements, the Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements, in light of one or several of the criteria listed in paragraph 2, as well as in view of the assessment of whether that category of products is:

Amendment 161 #

Proposal for a regulation
Article 7 – paragraph 1

By way of derogation from Article 2(1), third subparagraph, point (b), of Regulation [General Product Safety Regulation] where products with digital elements are not subject to specific requirements laid down in other Union harmonisation legislation within the meaning of [Article 3, point (25) of the General Product Safety Regulation], Chapter III, Section 1, Chapters V and VII, and Chapters IX to XI of Regulation [General Product Safety Regulation] shall apply to those products with respect to safety risks not covered byProducts with digital elements as defined and falling within the scope of [General Product Safety Regulation] shall be deemed as complying with the cybersecurity requirements for the purpose of [Article 5 of General Product Safety Regulation] if they comply with the requirements of this Regulation.

Amendment 162 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN

Proposal for a regulation
Article 7 – paragraph 1

~~By way of derogation from Article 2(1), third subparagraph, point (b), of~~Products falling under the Regulation [General Product Safety Regulation] wheich are products with digital elements ~~are not subject to specific requirements laid down~~ within the meaning other Union harmonisation legislation within the meaning of [Article 3, point (25) of the General Product Safety Regulation], Chapter III, Section 1, Chapters V and VII, and Chapters IX to XI of Regulation [General Product Safety Regulation] shall apply to those products with respect to safety risks not covered byf this Regulation shall be deemed to be in conformity with Article 5a-1(h) of the General Product Safety Regulation], when they comply with the requirements of this Regulation.

Amendment 163 #

Proposal for a regulation
Article 8 – paragraph 1

1. Products with digital elements or partly completed products with digital elements classified as high-risk AI systems in accordance with Article [Article 6] of Regulation [the AI Regulation] which fall within the scope of this Regulation, and fulfil the essential requirements set out in Section 1 of Annex I of this Regulation, and where the processes put in place by the manufacturer are compliant with the essential requirements set out in Section 2 of Annex I, shall be deemed in compliance with the requirements related to cybersecurity set out in Article [Article 15] of Regulation [the AI Regulation], without prejudice to the other requirements related to accuracy and robustness included in the aforementioned Article, and in so far as the achievement of the level of protection required by those requirements is demonstrated by the EU declaration of conformity issued under this Regulation.

Amendment 164 #

Andreas SCHWAB, Deirdre CLUNE

Proposal for a regulation
Article 8 – paragraph 2

2. For the products and cybersecurity requirements referred to in paragraph 1, the relevant conformity assessment procedure as required by Article [Article 43] of Regulation [AI Regulation] shall apply. For the purpose of that assessment, notified bodies which are entitled to control the conformity of the high-risk AI systems under the Regulation [AI Regulation] shall be also entitled to control the conformity of the high-risk AI systems within the scope of this Regulation with the requirements set out in Annex I to this Regulation, provided that the compliance of those notified bodies with the requirements laid down in Article 29 of this Regulation have been assessed in the context of the notification procedure under Regulation [AI Regulation].deleted

Amendment 165 #

Proposal for a regulation
Article 8 – paragraph 2

2. For the products and cybersecurity requirements referred to in paragraph 1, the relevant conformity assessment procedure as required by ~~Article [Article 43] of~~the [applicable provisions] Regulation [AI Regulation] shall apply. For the purpose of that assessment, notified bodies which are entitled to control the conformity of the high-risk AI systems under the Regulation [AI Regulation] shall be also entitled to control the conformity of the high-risk AI systems within the scope of this Regulation with the requirements set out in Annex I to this Regulation, provided that the compliance of those notified bodies with the requirements laid down in Article 29 of this Regulation have been assessed in the context of the notification procedure under Regulation [AI Regulation].

Amendment 166 #

Andreas SCHWAB, Deirdre CLUNE

Proposal for a regulation
Article 8 – paragraph 3

3. By derogation from paragraph 2, critical products with digital elements listed in Annex III of this Regulation, which have to apply the conformity assessment procedures referred to in Articles 24(2)(a), 24(2)(b), 24(3)(a) and 24(3)(b) under this Regulation and which are also classified as high-risk AI systems according to Article [Article 6] of the Regulation [AI Regulation] and to which the conformity assessment procedure based on internal control referred to in Annex [Annex VI] to Regulation [the AI Regulation] applies, shall be subject to the conformity assessment procedures as required by this Regulation in so far as the essential requirements of this Regulation are concerned.deleted

Amendment 167 #

Proposal for a regulation
Article 8 – paragraph 3

Amendment 168 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN

Proposal for a regulation
Article 9 – paragraph 1

Machinery products under the scope of Regulation [Machinery Regulation proposal] which are products with digital elements within the meaning of this Regulation and for which an EU declaration of conformity has been issued on the basis of this Regulation shall be deemed to be in conformity with the essential health and safety requirements set out in Annex [Annex III, Sections 1.1.9 and 1.2.1] to Regulation [Machinery Regulation proposal], as regards protection against corruption and safety and reliability of control systems, and in so far as the achievement of the level of protection required by those requirements is demonstrated in the EU declaration of conformity issued under this Regulation.deleted

Amendment 169 #

Proposal for a regulation
Article 9 – paragraph 1

Machinery products under the scope of Regulation [Machinery Regulation proposal] which are products with digital elements or partly completed products with digital elements within the meaning of this Regulation and for which an EU declaration of conformity has been issued on the basis of this Regulation shall be deemed to be in conformity with the essential health and safety requirements set out in Annex [Annex III, Sections 1.1.9 and 1.2.1] to Regulation [Machinery Regulation proposal], as regards protection against corruption and safety and reliability of control systems, and in so far as the achievement of the level of protection required by those requirements is demonstrated in the EU declaration of conformity issued under this Regulation.

Amendment 170 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 9 – paragraph 1 a (new)

By derogation from paragraph 1, products with digital elements which are also machinery products that fall within the categories listed in Annex I of Regulation [Machinery Regulation proposal], shall be subject to the specific conformity assessment procedures as required by Article 21(2) and (3) of Regulation [Machinery Regulation proposal].

Amendment 171 #

Proposal for a regulation
Article 10 – paragraph -1 (new)

-1. Software manufacturers which qualify as a microenterprise as defined in Commission Recommendation 2003/361/EC shall make best efforts to comply with the requirements in this Regulation during the 18 months from placing a software on the market.

Amendment 172 #

Proposal for a regulation
Article 10 – paragraph 1

1. When placing a product with digital elements on the market, manufacturers shall take reasonable measures to ensure that it has been designed, developed and produced in accordance with the essential requirements set out in Section 1 of Annex I.

Amendment 173 #

Proposal for a regulation
Article 10 – paragraph 2

2. For the purposes of complying with the obligation laid down in paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a data connection to an external device or network of a product with digital elements and take the outcome of that assessment into account during the planning, design, development, production, delivery and maintenance phases of the product with digital elements with a view to minimising cybersecurity risks, preventing security incidents and minimising the impacts of such incidents, including in relation to the health and safety of users.

Amendment 174 #

Proposal for a regulation
Article 10 – paragraph 3

3. When placing a product with digital elements on the market, the manufacturer shall include a cybersecurity risk assessment in the technical documentation as set out in Article 23 and Annex V in a manner suitable for distribution of that component and which does not limit the options for further making available of the component. For products with digital elements referred to in Articles 8 and 24(4) that are also subject to other Union acts, the cybersecurity risk assessment may be part of the risk assessment required by those respective Union acts. Where certain essential requirements are not applicable to the marketed product with digital elements, the manufacturer shall include a clear justification in that documentation.

Amendment 175 #

Proposal for a regulation
Article 10 – paragraph 4

4. For the purposes of complying with the obligation laid down in paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties in products with digital elements. ~~They shall~~It falls upon the manufacturer to ensure that such components do not compromise the security of the product with digital elements, in particular in the case of open source software that have not been placed on the market by charging a price or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. The due diligence obligation can be considered fulfilled if all components have been already deemed compliant and the CE marking has been affixed to them as appropriate.

Amendment 176 #

Proposal for a regulation
Article 10 – paragraph 4

Amendment 177 #

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

When placing a product with digital elements on the market, ~~and for~~the manufacturer shall define the expected product lifetime or for a period of five years from the placing of the product on the market, whichever is shorter, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I. . In doing so, the manufacturer shall ensure that the expected product lifetime is in line with reasonable consumer expectations and that it promotes sustainability and the need to ensure long-lasting products with digital elements. Manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I during at least the expected product lifetime or 10 years, whichever is shorter. Where applicable, the expected product lifetime shall be clearly stated on the product, its packaging or be included in contractual agreements.

Amendment 178 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

Amendment 179 #

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

When placing a product with digital elements on the market, and for the expected product lifetime ~~or for a period of five years from the placing of the product on the market, whichever is shorter~~, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I.

Amendment 180 #

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

When placing a product with digital elements on the market, and for the expected product lifetime at the time of placing that product on the market or for a period of five years from the placing of the product on the market, whichever is shorter, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I.

Amendment 181 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

When placing a product with digital elements on the market, and for ~~the expected product lifetime or for~~ a period of five years from the placing of the product on the market~~, whichever is shorter~~ or a shorter period, appropriate to the type and specificity of product, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I.

Amendment 182 #

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1 a (new)

Manufacturers shall set out the expected product lifetime considering the reasonable expectations of consumers regarding the functionality and intended purpose of the product, and the provision of security and functionality updates.

Amendment 183 #

Proposal for a regulation
Article 10 – paragraph 8

8. Manufacturers shall keep the technical documentation and the EU declaration of conformity, ~~where relevant,~~ at the disposal of the market surveillance authorities for at least ten years after the product with digital elements has been placed on the market.

Amendment 184 #

Proposal for a regulation
Article 10 – paragraph 9

9. Manufacturers shall ensure that procedures are in place for products with digital elements that are part of a series of production to remain in conformity. The manufacturer shall adequately take into account changes in the development and production process or in the design or characteristics of the product with digital elements and changes in the harmonised standards, European cybersecurity certification schemes or the common specifications referred to in Article 19 by reference to which the conformity of the product with digital elements is declared or by application of which its conformity is verified. Where new knowledge, techniques, or standards become available, which were not available at the time of design of a serial product, the manufacturer may consider implementing such improvements periodically for future product generations. The manufacturer shall take into account the associated costs and efforts, including the efforts required for development, testing, validation, and approval process time.

Amendment 185 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI

Proposal for a regulation
Article 10 – paragraph 9 a (new)

9 a. Manufacturers shall publicly communicate and advertise the expected product lifetime of their products, in a clear and understandable manner, and in particular the minimal duration of the provision of security updates.

Amendment 186 #

Proposal for a regulation
Article 10 – paragraph 10 a (new)

10 a. Manufacturers shall indicate the expected product lifetime in a clear and understandable manner. Where applicable, manufacturers shall also specify the expected product lifetime on the packaging of the product with digital elements.

Amendment 187 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 10 – paragraph 12

12. From the placing on the market and for the expected product lifetime ~~or for a period of five years after the placing on the market of a product with digital elements, whichever is shorter~~, manufacturers who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the manufacturer’s processes into conformity, to withdraw or to recall the product, as appropriate.

Amendment 188 #

Proposal for a regulation
Article 10 – paragraph 12

12. From the placing on the market and for the expected product lifetime or for a period of five years after the placing on the market of a product with digital elements, whichever is shorter, manufacturers who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the manufacturer’s processes into conformity, ~~to withdraw or to recall the product, as appropriate~~or publish the source code under free and open source license with this information in order to encourage research and innovation.

Amendment 189 #

Proposal for a regulation
Article 10 – paragraph 12

12. From the placing on the market and for ~~the expected product lifetime or for~~ a period of five years after the placing on the market ofr a shorter period, appropriate to the type and specificity of product with digital elements, ~~whichever is shorter,~~ manufacturers who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I shall ~~immediately~~without undue delay take reasonable measures proportionate to the risk, take the corrective measures necessary to bring that product with digital elements or the manufacturer’s processes into conformity, to withdraw or to recall the product, as appropriate.

Amendment 190 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 10 – paragraph 15

15. The Commission may, by means of ~~implementing~~delegated acts, specify the format and elements of the software bill of materials set out in Section 2, point (1), of Annex I. ~~Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 51(2).~~

Amendment 191 #

Proposal for a regulation
Article 10 – paragraph 15 a (new)

15 a. Manufacturers shall make publicly available communication channels such as a telephone number, electronic address or dedicated section of their website, taking into account accessibility needs for persons with disabilities, enabling users of products with digital elements to submit complaints electronically and free of charge.

Amendment 192 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Article 11 – paragraph 1

1. The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited vulnerability contained in the product with digital elements. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of Member States concerned upon receipt and immediately inform the market surveillance authority about the notified vulnerability. Where a notified vulnerability has no corrective or mitigating measures available, ENISA shall ensure that information about the notified vulnerability is shared in line with strict security protocols and on a need-to-know-basis.

Amendment 193 #

Proposal for a regulation
Article 11 – paragraph 1

1. The manufacturer shall, without undue delay and ~~in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited~~when it has a reasonable belief that a critical or high vulnerability listed in the known exploited vulnerability catalogue referred to in paragraph 5a is present and exploitable in the product with digital elements, and after clear remediation guidance is made available, notify to ENISA such listed known vulnerability contained in the product with digital elements. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of Member States concerned upon receipt and inform the market surveillance authority about the notified vulnerability.

Amendment 194 #

Proposal for a regulation
Article 11 – paragraph 1

1. The manufacturer shall, ~~without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA~~notify relevant Computer Security Incident Response Teams (CSIRTs) or, where applicable, competent authority of the Member State established under Directive (EU) 2022/2555, any actively exploited vulnerability ~~contained i~~with significant impact on the product with digital elements. The notification shall ~~include details concerning~~be submitted without undue delay after thate vulnerability and, where applicable, any corrective or mitigating measures taken. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of Member States concerned upon receipt and inform the market surveillance authority about the notified vulnerabilityhas been addressed and shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken.

Amendment 195 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN

Proposal for a regulation
Article 11 – paragraph 1

1. The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited vulnerability contained in the product with digital elements. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken and the recommended risk mitigation measures. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of Member States concerned upon receipt and inform the market surveillance authority about the ~~notified vulnerability~~existence of a vulnerability and where applicable, the potential risk mitigation measures.

Amendment 196 #

Proposal for a regulation
Article 11 – paragraph 2

2. The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, by means of an early warning, notify to ENISA of any incident having a significant impact on the security of the product with digital elements. The manufacturer shall without undue delay and in any event within 72 hours of becoming aware of the significant incident related to the product with digital elements further notify ENISA more details on the significant incident. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notifications to the single point of contact designated in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of the Member States concerned and immediately inform the market surveillance authority about the notified incidents. The incident notification shall include information on the severity and impact of the incident and, where applicable, indicate whether the manufacturer suspects the incident to be caused by unlawful or malicious acts or considers it to have a cross-border impact.

Amendment 197 #

Proposal for a regulation
Article 11 – paragraph 2

2. The manufacturer shall, without undue delay and ~~in any event within 24 hours of becoming aware of it, notify to ENISA~~when it has a reasonable belief that a significant incident has occurred, notify any incident having a significant impact on the security of the product ~~with digital elements. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification~~development, build and distribution environment of the product with digital elements to the single point of contact designated in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of the Member States concerned and inform the market surveillance authority about the notified significant incidents. The significant incident notification shall include ~~information on the severity and impact of the incident~~strictly necessary information to make the competent authority aware of the incident and allow the entity to seek assistance if requires and, where applicable, indicate whether the manufacturer suspects the incident to be caused by unlawful or malicious acts or considers it to have a cross-border impact. The mere act of notification shall not subject the notifying entity to increased liability.

Amendment 198 #

Proposal for a regulation
Article 11 – paragraph 2

2. The manufacturer shall, without undue delay ~~and in any~~ from the moment it becomes aware, notify to releveant ~~within 24 hours of becoming aware of it, notify to ENISA any~~CSIRTs or, where applicable, competent authority of the Member State established under Directive (EU) 2022/2555, any major incident having a significant impact on the security of the product with digital elements. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notifications to the single point of contact designated in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of the Member States concerned and inform the market surveillance authority about the notified incidents. The incident notification shall include informationThe incident notification shall be submitted without undue delay and include information strictly necessary to make the competent authority aware of the incident, and where relevant and proportionate to the risk, on the severity and impact of the incident and, where applicable, indicate whether the manufacturer suspects the incident to be caused by unlawful or malicious acts or considers it to have a cross-border impact.

Amendment 199 #

Proposal for a regulation
Article 11 – paragraph 3

3. ~~ENISA shall submit to the European cyber crisis liaison organisation network (EU-CyCLONe) established by Article [Article X] of Directive [Directive XXX/XXXX (NIS2)]~~CSIRTs or, where applicable, competent authority of the Member State established under Directive (EU) 2022/2555, shall submit to ENISA information notified pursuant to paragraphs 1 and 2 if such information is relevant for the coordinated management of large-scale cybersecurity incidents and crises at an operational level. ENISA shall submit the information received by the CSIRTs or, where applicable, competent authority of the Member State established under Directive (EU) 2022/2555, to the European cyber crisis liaison organisation network (EUCyCLONe) established by Article 16 of Directive (EU) 2022/2555.

Amendment 200 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 11 – paragraph 3

3. ENISA shall submit to the European cyber crisis liaison organisation network (EU-CyCLONe) established by Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] information notified pursuant to paragraphs 1 ~~and 2~~ if such information is relevant for the coordinated management of large-scale cybersecurity significant incidents and crises at an operational level.

Amendment 201 #

Proposal for a regulation
Article 11 – paragraph 4

4. The manufacturer shall inform, without undue delay and after becoming aware, the users of the product with digital elements about the incident and~~, where necessary,~~ about corrective measures that the user can deploy to mitigate the impact of the incident, and provide them with technical information on the exploited vulnerability, concerned data and potential damage.

Amendment 202 #

Proposal for a regulation
Article 11 – paragraph 4

4. The manufacturer shall inform, without undue delay and after becoming aware, the users of the product with digital elements about ~~the incid~~a significant incident having major impact on the security of the product with digital elements and, where necessary, about corrective measures that the user can deploy to mitigate the impact of the incident.

Amendment 203 #

Proposal for a regulation
Article 11 – paragraph 4

4. The manufacturer shall inform, without undue delay and after becoming aware, the users of the product with digital elements ~~about the~~, where appropriate and if likely to be adversely affected by the significant incident and, where necessary, about corrective measures that the user can deploy to mitigate the impact of the incident.

Amendment 204 #

Proposal for a regulation
Article 11 – paragraph 4

4. The manufacturer shall inform, without undue delay and after becoming aware, the users of the product with digital elements about the incident and, where necessary, about risk mitigation and any corrective measures that the user can deploy to mitigate the impact of the incident.

Amendment 205 #

Proposal for a regulation
Article 11 – paragraph 5

5. The Commission, after consulting stakeholders and CSIRTs may, by means of implementing acts, specify further the type of information, format and procedure of the notifications submitted pursuant to paragraphs 1 and 2. Those implementing acts shall be based on European and international standards, such as ISO/IEC 29147 and adopted in accordance with the examination procedure referred to in Article 51(2).

Amendment 206 #

Proposal for a regulation
Article 11 – paragraph 6

6. ENISA, on the basis of the notifications received pursuant to paragraphs 1 and 2, shall prepare a biennial technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group referred to in Article [Article X] of Directive [Directive XXX/XXXX (NIS2)]. The first such report shall be submitted within 24 months after the obligations laid down in paragraphs 1 ~~and 2~~ start applying.

Amendment 207 #

Proposal for a regulation
Article 11 – paragraph 6

6. ENISA, on the basis of the notifications received pursuant to paragraphs 1, 2 and 23, shall prepare a biennial technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group referred to in Article ~~[Article X]~~14 of Directive ~~[Directive XXX/XXXX (NIS2)]~~(EU) 2022/2555. The first such report shall be submitted within 24 months after the obligations laid down in paragraphs 1 and 2 start applying.

Amendment 208 #

Proposal for a regulation
Article 11 – paragraph 7

7. Manufacturers shall, upon identifying a vulnerability in a component, including in an open source component, which is integrated in the product with digital elements, report the vulnerability and the corrective or mitigating measure taken, to the person or entity maintaining the component. Such corrective or mitigating measures shall be accompanied by the relevant code and appropriate licenses that allow the deployment. This does not release the manufacturer from the obligation to maintain the compliance of the product with the requirements of this Regulation, nor does it create obligations for the developers of free and open source components that have no contractual relation to the said manufacturer.

Amendment 209 #

Proposal for a regulation
Article 11 a (new)

Article 11 a Single point of contact for users 1. Manufacturers shall designate a single point of contact to enable users to communicate directly and rapidly with them, where applicable by electronic means and in a user-friendly manner, including by allowing recipients of the service to choose the means of communication, which shall not solely rely on automated tools. 2. In addition to the obligations provided under Directive 2000/31/EC, manufacturers shall make public the information necessary for the end users in order to easily identify and communicate with their single points of contact. That information shall be easily accessible and shall be kept up to date.

Amendment 210 #

Proposal for a regulation
Article 13 – paragraph 2 – point c a (new)

(c a) all the documents proving the fulfilment of the requirements set in this article have been received from the manufacturer and are available for inspection.

Amendment 211 #

Proposal for a regulation
Article 13 – paragraph 6 – subparagraph 1

Importers who know or have reason to believe that a product with digital elements, which they have placed on the market, or the processes put in place by its manufacturer, are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the processes put in place by its manufacturer into conformity with the essential requirements set out in Annex I, or to withdraw or recall the product, if appropriate. Based on a risk assessment, distributors and end users shall be timely informed of the lack of compliance and the risk mitigation measures they can take.

Amendment 212 #

Proposal for a regulation
Article 14 – paragraph 2 – point b a (new)

(b a) they have received from the importer all the information and documentation required by this regulation.

Amendment 213 #

Proposal for a regulation
Article 16 – paragraph 1

A natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of the product with digital elements and makes the product available on the market, shall be considered a manufacturer for the purposes of this Regulation.

Amendment 214 #

Proposal for a regulation
Article 16 – paragraph 1

A natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of the product with digital elements and makes it available on the market shall be considered a manufacturer for the purposes of this Regulation.

Amendment 215 #

Proposal for a regulation
Article 17 – paragraph 1 – introductory part

1. Economic operators shall, on request ~~and where the information is available~~, provide to the market surveillance authorities the following information:

Amendment 216 #

Proposal for a regulation
Article 18 – paragraph 1 a (new)

1 a. The Commission shall, as provided in Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft harmonised standards for the requirements set out in Annex I.

Amendment 217 #

Proposal for a regulation
Article 18 – paragraph 2

2. Products with digital elements and processes put in place by the manufacturer, which are in conformity with the common specifications referred to in Article 19 shall be presumed to be in conformity with the essential requirements set out in Annex I, to the extent those common specifications cover those requirements.deleted

Amendment 218 #

Proposal for a regulation
Article 18 – paragraph 4

4. The Commission is empowered, by means of implementing acts, to specify the European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 that can be used to demonstrate conformity with the essential requirements or parts thereof as set out in Annex I. Furthermore, where applicable, the Commission shall specify if a cybersecurity certificate issued under such schemes eliminates the obligation of a manufacturer to carry out a third-party conformity assessment for the corresponding requirements, as set out in Article 24(2)(a), (b), (3)(a) and (b). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 51(2).deleted

Amendment 219 #

Proposal for a regulation
Article 18 – paragraph 4 a (new)

4 a. In accordance with Article 10(1) of Regulation 1025/2012, when preparing the Standardisation Request for this Regulation, the Commission shall aim for maximum harmonisation with existing or imminent international standards for cybersecurity. In the first three years following the date of application of this Regulation, the Commission is empowered to declare an existing international standard as meeting the requirements of this Regulation, without any European modifications, provided that adherence to such standards sufficiently enhances the security of products with digital elements, and provided that the standard is published as a separate version by one of the European Standardisation Organisations.

Amendment 220 #

Proposal for a regulation
Article 19

~~Where harmonised standards referred to in~~ Article 189 do not exist or where the Commission considers that the relevant harmonised standards are insufficient to satisfy the requirements of this Regulation or to comply with the standardisation request of the Commission, or where there are undue delays in the standardisation procedure or where the request for harmonised standards by the Commission has not been accepted by the European standardisation organisations, the Commission is empowered, by means of implementing acts, to adopt common specifications in respect of the essential requirements set out in Annex I. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 51(2). eleted Common specifications (This amendment applies throughout the text to all references of Common specifications.)

Amendment 221 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN

Proposal for a regulation
Article 19 – paragraph 1

Where harmonised standards referred to in Article 18 do not exist or where the Commission considers that the relevant harmonised standards are insufficient to satisfy the requirements of this Regulation or to comply with the standardisation request of the Commission, or where there are undue delays in the standardisation procedure or where the request for harmonised standards by1. The Commission may adopt implementing acts establishing common specifications covering technical requirements that provide a means to comply with the essential health and safety requirements set out in Annex I for products within the scope of this Regulation. Those implementing acts shall only be adopted where the following conditions are fulfilled: (a) the Commission has requested, pursuant to Article 10(1) of Regulation (EU) No 1025/2012, one or more European standardisation organisations to draft a harmonised standard for the essential requirements set out in Annex I and: (i) the request has not been accepted; or (ii) the harmonised standards addressing that request are not delivered within the deadline set in accordance with Article 10(1) of Regulation (EU) 1025/2012; or (iii) the harmonised standards do not comply with the request; and (b) no reference to harmonised standards covering the requirements set out in Annex I has been published in the Official Journal of the European Union in accordance with Regulation (EU) 1025/2012 and no such reference is expected to be published within a reasonable period. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(3). 2. Before preparing the draft implementing act referred to in paragraph 3, the Commission shall inform the committee referred to in Article 22 of Regulation (EU) 1025/2012 that it considers that the conditions in paragraph 3 have been fulfilled. 3. When preparing the draft implementing act referred to in paragraph 1, the Commission sha~~s not been acce~~ll take into account the views of relevant bodies or the expert group and shall duly consult all relevant stakeholders. 4. Where a harmonised standard is adopted by ~~the~~a European standardisation organisations, the Commission is empowered, by means of implementing acts, to adopt common specifications in respect of the essential requirements set out in Annex I. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 51(2). and proposed to the Commission for the purpose of publishing its reference in the Official Journal of the European Union, the Commission shall assess the harmonised standard in accordance with Regulation (EU) 1025/2012. When reference of a harmonised standard is published in the Official Journal of the European Union, the Commission shall repeal the implementing acts referred to in paragraph 1, or parts thereof which cover the same requirements as those covered by that harmonised standard. 5. When a Member State considers that a common specification does not entirely satisfy the requirements set out in Annex I, it shall inform the Commission thereof by submitting a detailed explanation. The Commission shall assess that detailed explanation and may, if appropriate, amend the implementing act establishing the common specification in question.

Amendment 222 #

Proposal for a regulation
Article 20 – paragraph 2

2. The EU declaration of conformity shall have the model structure set out in Annex IV and shall contain the elements specified in the relevant conformity assessment procedures set out in Annex VI. Such a declaration shall be ~~continuously updated~~updated as appropriate. It shall be made available in the language or languages required by the Member State in which the product with digital elements is placed on the market or made available.

Amendment 223 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN

Proposal for a regulation
Article 20 a (new)

Article 20 a EU Declaration of Incorporation for partly completed products with digital elements 1. The EU declaration of incorporation shall be drawn up by manufacturers in accordance with Article 10(7) and state that the fulfilment of the relevant essential requirements set out in Annex I has been demonstrated. 2. The EU declaration of incorporation shall have the model structure set out in Annex IVa (new). Such a declaration shall be updated as appropriate. It shall be made available in the language or languages required by the Member State in which the partly completed product with digital elements is placed on the market or made available. 3. Where a partly completed product with digital elements is subject to more than one Union act requiring an EU declaration of incorporation, a single EU declaration of incorporation shall be drawn up in respect of all such Union acts. That declaration shall contain the identification of the Union acts concerned, including their publication references. 4. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by adding elements to the minimum content of the EU declaration of incorporation as set out in Annex IVa (new) to take account of technological developments.

Amendment 224 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Article 22 – paragraph 1

1. The CE marking shall be affixed visibly, legibly and indelibly to the product with digital elements. Where that is not possible or not warranted on account of the nature of the product with digital elements, it shall be affixed to the packaging and to the EU declaration of conformity referred to in Article 20 accompanying the product with digital elements. For products with digital elements which are in the form of software, the CE marking shall be affixed either to the EU declaration of conformity referred to in Article 20 or on the website accompanying the software product. In the latter case, the relevant section of the website shall be easily and directly accessible to consumers.

Amendment 225 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Article 22 – paragraph 3

3. The CE marking shall be affixed before the product with digital elements is placed on the market. It may be followed by a pictogram or any other mark indicating to consumers a special risk or use set out in implementing acts referred to in paragraph 6.

Amendment 226 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Article 22 – paragraph 5

5. Member States shall build upon existing mechanisms to ensure correct and harmonised application of the regime governing the CE marking and shall take appropriate and coordinated action in the event of improper use of that marking. Where the product with digital elements is subject to other Union legislation which also provides for the affixing of the CE marking, the CE marking shall indicate that the product also fulfils the requirements of that other legislation.

Amendment 227 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Article 22 – paragraph 6

6. The Commission may, by means of ~~implementing~~delegated acts, lay down technical specifications for labelling schemes, including harmonised labels, pictograms or any other marks related to the security of the products with digital elements, and mechanisms to promote their use~~. Those implementing~~ among businesses and consumers and to increase public awareness about security of products with digital elements. Those delegated acts shall be adopted in accordance with the ~~examination~~ procedure referred to in Article 5~~1(2)~~0.

Amendment 228 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Article 22 – paragraph 6 a (new)

6 a. The Commission shall present easy-to-understand guidelines for businesses with the requirements of this Regulation. When developing such guidelines, the Commission should take into consideration needs of SMEs so as to keep administrative and financial burdens to a minimum while facilitating their compliance with this Regulation. The Commission should consult relevant stakeholders, with expertise in the field of cybersecurity.

Amendment 229 #

Proposal for a regulation
Article 22 – paragraph 6 a (new)

6 a. A partly completed product with digital elements shall not be marked with the CE marking under this Regulation without prejudice of marking provisions resulting from other applicable Union legislation.

Amendment 230 #

Proposal for a regulation
Article 23 – paragraph 2

2. The technical documentation shall be drawn up before the product with digital elements is placed on the market and shall be continuously updated, where appropriate, during the expected product lifetime or during a period of five years after the placing on the market of a product with digital elements, whichever is ~~short~~longer.

Amendment 231 #

Proposal for a regulation
Article 23 – paragraph 3

3. For products with digital elements ~~referred to in Articles 8 and 24(4)~~ that are also subject to other Union acts, one single technical documentation shall be drawn up containing the information referred to in Annex V of this Regulation and the information required by those respective Union acts.

Amendment 232 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI

Proposal for a regulation
Article 23 – paragraph 5

~~5. The Commission is empowered to adopt~~ delegated acts in accordance with Article 50 to supplement this Regulation by the elements to be included in the technical documentation set out in Annex V to take account of technological developments, as well as developments encountered in the implementation process of this Regulation.

Amendment 233 #

Proposal for a regulation
Article 23 – paragraph 5

5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by the elements to be included in the technical documentation set out in Annex V to take account of technological developments, as well as developments encountered in the implementation process of this Regulation. The Commission shall strive to minimise the administrative burden for small and medium sized enterprises.

Amendment 234 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN

Proposal for a regulation
Article 24 – paragraph 1 – point c a (new)

(c a) a European cybersecurity certification scheme adopted in accordance with Article 18(4) of Regulation (EU) 2019/881.

Amendment 235 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 24 – paragraph 2 – introductory part

2. Where, in assessing the compliance of the ~~critical~~ product with digital elements ~~of class I as set out in Annex III~~ and the processes put in place by its manufacturer with the essential requirements set out in Annex I, the manufacturer or the manufacturer’s authorised representative has not applied or has applied only in part harmonised standards, common specifications or European cybersecurity certification schemes as referred to in Article 18, or where such harmonised standards, common specifications or European cybersecurity certification schemes do not exist, the product with digital elements concerned and the processes put in place by the manufacturer shall be submitted with regard to those essential requirements to either of the following procedures:

Amendment 236 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN

Proposal for a regulation
Article 24 – paragraph 2 – point b a (new)

(b a) where applicable, a European cybersecurity certification scheme at assurance level ‘substantial’ or ‘high’ pursuant to Regulation (EU) 2019/881.

Amendment 237 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 24 – paragraph 3 – introductory part

3. Where the product is a critical product with digital elements ~~of class II as set out in Annex III~~, the manufacturer or the manufacturer’s authorised representative shall demonstrate conformity with the essential requirements set out in Annex I by using one of the following procedures:

Amendment 238 #

Proposal for a regulation
Article 24 – paragraph 4 a (new)

4 a. For products to which Union harmonisation legislation based on the New Legislative Framework apply, the manufacturer shall follow the relevant conformity assessment as required under those legal acts. The requirements set out in Chapter 3 shall apply to those products.

Amendment 239 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 24 – paragraph 5

5. Notified bodies shall take into account the specific interests and needs of micro, small and medium sized enterprises (SMEs) when setting the fees for conformity assessment procedures and reduce those fees proportionately to their specific interests and needs. The Commission shall take appropriate measures to ensure more accessible and affordable procedures, such as establishing a framework for providing appropriate financial support and guidance for the notified bodies.

Amendment 240 #

Proposal for a regulation
Article 24 – paragraph 5

5. Notified bodies shall take into account the specific interests and needs of small and medium sized enterprises (SMEs) when setting the fees for conformity assessment procedures and reduce those fees proportionately to their specific interests and needs. The Commission shall take appropriate measures to ensure more accessible and affordable procedures, including by establishing a framework for providing appropriate financial support.

Amendment 241 #

Proposal for a regulation
Article 24 – paragraph 5 a (new)

5 a. For products with digital elements falling within the scope of this Regulation and which are placed on the market or put into service by credit institutions regulated by Directive 2013/36/EU, the conformity assessment shall be carried out as part of the procedure referred to in Articles 97 to 101 of that Directive.

Amendment 242 #

Proposal for a regulation
Article 24 a (new)

Article 24 a Where products with digital elements have equitable hardware or software, one product model can be representative of a family of products for the purposes of the following conformity assessment procedures: (a) the internal control procedure (based on module A) set out in Annex VI; or (b) the EU-type examination procedure (based on module B) set out in Annex VI followed by conformity to EU-type based on internal production control (based on module C) set out in Annex VI.

Amendment 243 #

Proposal for a regulation
Article 25 – paragraph 1

Member States shall notify the Commission and the other Member States of conformity assessment bodies authorised to carry out conformity assessments in accordance with this Regulation. Member States and the Commission shall put in place appropriate measures to ensure sufficient availability of skilled professionals, in order to minimise bottlenecks in the activities pursuant to articles 26 to 31.

Amendment 244 #

Proposal for a regulation
Article 27 – paragraph 5

5. A notifying authority shall safeguard the confidentiality of the information it obtains, especially trade secrets and proprietary information.

Amendment 245 #

Proposal for a regulation
Article 27 – paragraph 6 a (new)

6 a. A notifying authority shall be organised in such a way so that bureaucracy and fees are at an absolute minimum, especially for SMEs.

Amendment 246 #

Proposal for a regulation
Article 29 – paragraph 10

10. The personnel of a conformity assessment body shall observe professional secrecy with regard to all information obtained in carrying out their tasks under Annex VI or any provision of national law giving effect to it, except in relation to the market surveillance authorities of the Member State in which its activities are carried out. Proprietary rights, trade secrets and other sensitive information shall be protected. The conformity assessment body shall have documented procedures ensuring compliance with this paragraph.

Amendment 247 #

Proposal for a regulation
Article 29 – paragraph 12

12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, in particular taking into account the interests of SMEs in relation to fees and also respecting the confidentiality of trade secrets and proprietary information.

Amendment 248 #

Proposal for a regulation
Article 29 – paragraph 12

12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, in particular taking into account the interests of ~~SME~~micro, small and medium enterprises in relation to fees.

Amendment 249 #

Proposal for a regulation
Article 29 – paragraph 12

12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions in line with Article 37(2), in particular taking into account the interests of SMEs in relation to fees.

Amendment 250 #

Proposal for a regulation
Article 36 – paragraph 3

3. The Commission shall ensure that all trade secrets and sensitive information obtained in the course of its investigations is treated confidentially.

Amendment 251 #

Proposal for a regulation
Article 37 – paragraph 2

2. Conformity assessments shall be carried out in a proportionate manner, avoiding unnecessary burdens for economic operators, with special considerations for SMEs. Conformity assessment bodies shall perform their activities taking due account of the size of an undertaking, the sector in which it operates, its structure, the degree of complexity of the product technology in question and the mass or serial nature of the production process.

Amendment 252 #

Proposal for a regulation
Article 37 – paragraph 2

2. Conformity assessments shall be carried out in a proportionate manner, avoiding unnecessary burdens for economic operators. Conformity assessment bodies shall perform their activities taking due account of the size of an undertaking, the sector in which it operates, its structure, the degree of complexity and the risk exposure of the product type and technology in question and the mass or serial nature of the production process.

Amendment 253 #

Proposal for a regulation
Article 39 – paragraph 1

The Commission shall provide for the organisation of exchange of experience between the Member States' national authorities responsible for notification policy. Experience and knowledge which also can facilitate corporate compliance must also be made publicly available by the Commission.

Amendment 254 #

Proposal for a regulation
Article 40 – paragraph 1

1. The Commission shall ensure that appropriate coordination and cooperation between notified bodies are put in place in a way that reduces bureaucracy and fees, and properly operated in the form of a cross-sectoral group of notified bodies.

Amendment 255 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Article 40 – paragraph 2

2. Member States shall ensure that the bodies notified by them participate in the work of that group, directly or by means of designated representatives, in a way that reduces bureaucracy and fees.

Amendment 256 #

Proposal for a regulation
Article 41 – paragraph 3

3. Where relevant, the market surveillance authorities shall cooperate with the national cybersecurity certification authorities designated under Article 58 of Regulation (EU) 2019/881 and exchange information on a regular basis. With respect to the supervision of the implementation of the reporting obligations pursuant to Article 11 of this Regulation, the designated market surveillance authorities shall effectively cooperate with ENISA. The market surveillance authorities may request ENISA to provide technical advice on matters related to the implementation and enforcement of this Regulation, including during investigations in accordance with Article 43.

Amendment 257 #

Proposal for a regulation
Article 41 – paragraph 3

Amendment 258 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Article 41 – paragraph 3 a (new)

3 a. With respect to the supervision of the implementation of the reporting obligations pursuant to Article 11 of this Regulation, the designated market surveillance authorities shall cooperate with ENISA. The market surveillance authorities may request ENISA to provide technical advice on matters related to the implementation and enforcement of this Regulation. When conducting an investigation under Article 43, market surveillance authorities may request ENISA to provide non-binding evaluations of compliance of products with digital elements.

Amendment 259 #

Proposal for a regulation
Article 41 – paragraph 7

7. The Commission shall facilitate the regular and structured exchange of experience between designated market surveillance authorities, including via a dedicated administrative cooperation group (ADCO) established under paragraph 11 of this Article.

Amendment 260 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 41 – paragraph 8

8. Market surveillance authorities may provide guidance and advice to economic operators on the implementation of this Regulation, with the support of the Commission. Market surveillance authorities shall be equipped to receive complaints by consumers affected by products with digital elements if they consider that the relevant products or the practices engaged infringe this Regulation, and shall facilitate the active participation of civil society in market surveillance activities, including scientific, research and consumer organisations, by establishing a clear and accessible mechanism to facilitate reporting of vulnerabilities, incidents, and cyber threats.

Amendment 261 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Article 41 – paragraph 11

11. A dedicated administrative cooperation group (ADCO) shall be established for the uniform application of this Regulation, ~~pursuant to Article 30(2) of Regulation (EU) 2019/1020. This ADCO~~to facilitate structured cooperation in relation to the implementation of this Regulation and to streamline the practices of market surveillance authorities within the Union, pursuant to Article 30(2) of Regulation (EU) 2019/1020. This ADCO shall have, in particular, the tasks referred to in Article 32(2) of Regulation (EU) 2019/1020 and shall be composed of representatives of the designated market surveillance authorities, ENISA and, if appropriate, representatives of single liaison offices. The ADCO shall meet at regular intervals and, where necessary, at the duly justified request of the Commission or ENISA or a Member State and shall coordinate its action with other existing Union activities related to market surveillance and consumer safety and, where relevant, shall cooperate and exchange information with other Union networks, groups and bodies. The ADCO may invite experts and other third parties, including consumer organisations, to attend its meetings.

Amendment 262 #

Proposal for a regulation
Article 41 – paragraph 11 a (new)

11 a. For products with digital elements falling within the scope of this Regulation, distributed, put into service or used by financial institutions regulated by relevant Union legislation on financial services, the market surveillance authority for the purposes of this Regulation shall be the relevant authority responsible for the financial supervision of those institutions under that legislation.

Amendment 263 #

Proposal for a regulation
Article 41 – paragraph 11 a (new)

11 a. Market surveillance authorities shall facilitate the active participation of stakeholders in market surveillance activities, including scientific, research and consumer organisations, by establishing a clear and accessible mechanism to facilitate the voluntary reporting of vulnerabilities, incidents, and cyber threats.

Amendment 264 #

Proposal for a regulation
Article 41 a (new)

Article 41 a Expert group on technical matters 1. The Commission shall establish an expert group in order to provide technical advice to the Commission and competent authorities on matters related to in the implementation and enforcement of this Regulation. In particular, the expert group shall provide non-binding evaluations of products with digital elements upon request by a market surveillance authority that is conducting an investigation under Article 43 and guidance on the application of relevant concepts to software and the exclusion of free and open source software. 2. The expert group shall consist of independent experts appointed for a renewable three-year term by the Commission on the basis of their scientific or technical expertise in the field. The Commission shall appoint a number of experts which is deemed sufficient to fulfil the foreseen needs, ensuring that their professional background and affiliations result in a balanced representation of stakeholder interests, in particular open source organisations, national accreditation bodies, conformity assessment bodies pursuant to Regulation (EC) 765/2008 of the European Parliament and of the Council, data protection authorities, as well as academia and consumer organisations. 3. The Commission shall take the necessary measures to manage and prevent any conflicts of interest. The Declarations of interests of the members of the expert group shall be made publicly available. 4. The appointed experts shall perform their tasks with the highest level of professionalism, independence, impartiality and objectivity. 5. When adopting positions, views and reports, the expert group shall attempt to reach consensus. If consensus cannot be reached, decisions shall be taken by a qualified majority of the group members.

Amendment 265 #

Proposal for a regulation
Article 42 – paragraph 1

Where necessary to assess the conformity of products with digital elements and the processes put in place by their manufacturers with the essential requirements set out in Annex I and upon a reasoned request, the market surveillance authorities shall be granted access to the data required to assess the design, development, production and vulnerability handling of such products, including related internal documentation of the respective economic operator. Where appropriate, and in accordance with Article 52(1) point (a), this shall be in a secure, controlled environment determined by the manufacturer.

Amendment 266 #

Proposal for a regulation
Article 43 – paragraph 1 – subparagraph 2

Where, in the course of that evaluation, the market surveillance authority finds that the product with digital elements does not comply with the requirements laid down in this Regulation or otherwise present threat to national security, it shall without delay require the relevant operator to take all appropriate corrective actions to bring the product into compliance with those requirements, to withdraw it from the market, or to recall it within a reasonable period, commensurate with the nature of the risk, as it may prescribe.

Amendment 267 #

Proposal for a regulation
Article 43 – paragraph 1 – subparagraph 2

Where, in the course of that evaluation, the market surveillance authority finds that the product with digital elements does not comply with the requirements laid down in this Regulation, it shall without delay require the relevant economic operator to take all appropriate corrective actions to bring the product into compliance with those requirements, to withdraw it from the market, or to recall it within a ~~reasonabl~~n adequate period, commensurate with the nature of the risk~~, as it may prescribe~~.

Amendment 268 #

Proposal for a regulation
Article 43 – paragraph 4 – subparagraph 1

Where the manufacturer of a product with digital elements does not take adequate corrective action within the period referred to in paragraph 1, second subparagraph, or the relevant Member States authority consider product to present threat to the national security, the market surveillance authority shall take all appropriate provisional measures to prohibit or restrict that product being made available on its national market, to withdraw it from that market or to recall it.

Amendment 269 #

Proposal for a regulation
Article 43 – paragraph 7

7. Where, within three months of receipt of the information referred to in paragraph 4, no objection has been raised by either a Member State or the Commission in respect of a provisional measure taken by a Member State, that measure shall be deemed justified. The decision referred to in paragraph 1, concerning threat to national security shall always be deemed justified. This is without prejudice to the procedural rights of the operator concerned in accordance with Article 18 of Regulation (EU) 2019/1020.

Amendment 270 #

Proposal for a regulation
Article 45 – paragraph 1

1. Where the Commission has sufficient reasons to consider, including based on information provided by the competent authorities of Member States, the computer security incident response teams (CSIRTs) designated or established in accordance with Directive (EU) 2022/2555 or ENISA, that a product with digital elements that presents a significant cybersecurity risk is non-compliant with the requirements laid down in this Regulation, it may request the relevant market surveillance authorities to carry out an evaluation of compliance and follow the procedures referred to in Article 43.

Amendment 271 #

Proposal for a regulation
Article 45 – paragraph 1

1. Where the Commission has sufficient reasons to consider, including based on information provided by ENISA, that a product with digital elements that presents a significant cybersecurity risk is non-compliant with the requirements laid down in this Regulation, it ~~may~~shall request the relevant market surveillance authorities to carry out an evaluation of compliance and follow the procedures referred to in Article 43.

Amendment 272 #

Proposal for a regulation
Article 45 – paragraph 2

2. In exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market and where the Commission ~~has~~ sufficient reasons, substantiated by relevant data, to consider that the product referred to in paragraph 1 remains non- compliant with the requirements laid down in this Regulation and no effective measures have been taken by the relevant market surveillance authorities, the Commission may request ~~ENISA~~the relevant Member State authority to carry out an evaluation of compliance. The Commission shall inform the relevant market surveillance authorities and ENISA accordingly. ~~The relevant economic operators shall cooperate as necessary with ENISA.~~

Amendment 273 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 45 – paragraph 2

2. In ~~exceptional~~ circumstances which justify an immediate intervention to preserve the good functioning of the internal market and where the Commission has ~~sufficient~~ reasons to consider that the product referred to in paragraph 1 remains non-compliant with the requirements laid down in this Regulation and no effective measures have been taken by the relevant market surveillance authorities, the Commission ~~may~~shall request ENISA to carry out an evaluation of compliance. The Commission shall inform the relevant market surveillance authorities accordingly. The relevant economic operators shall cooperate as necessary with ENISA.

Amendment 274 #

Proposal for a regulation
Article 45 – paragraph 2

Amendment 275 #

Proposal for a regulation
Article 45 – paragraph 3

3. Based on ~~ENISA’s evalu~~the Member State authority's evaluation and recommendation, the 3. Commission may decide that a corrective or restrictive measure is necessary at Union level. To this end, it shall without delay consult the Member States concerned and the relevant economic operator or operators.

Amendment 276 #

Proposal for a regulation
Article 46 – paragraph 1

1. Where, having performed an evaluation under Article 43, the market surveillance authority of a Member State finds that although a product with digital elements and the processes put in place by the manufacturer are in compliance with this Regulation, they present a significant cybersecurity risk and, in addition, they pose a risk to the health or safety of persons, to the compliance with obligations under Union or national law intended to protect fundamental rights, the availability authenticity, integrity or confidentiality of services offered using an electronic information system by essential entities of the type referred to in [Annex I to Directive XXX / XXXX (NIS2)] or to other aspects of public interest protection, it shall require the relevant economic operator to take all appropriate measures to ensure that the product with digital elements and the processes put in place by the manufacturer concerned, when placed on the market, no longer present that risk, to withdraw the product with digital elements from the market or to recall it within a ~~reasonabl~~n adequate period, commensurate with the nature of the risk.

Amendment 277 #

Proposal for a regulation
Article 46 – paragraph 2

2. The manufacturer or other relevant economic operators shall ensure that corrective action is taken in respect of the products with digital elements concerned that they have made available on the market throughout the Union within the timeline established by the market surveillance authority of the Member State referred to in paragraph 1.

Amendment 278 #

Proposal for a regulation
Article 46 – paragraph 6

6. Where the Commission has sufficient reasons to consider, including based on information provided by ENISA, that a product with digital elements, although compliant with this Regulation, presents the risks referred to in paragraph 1, it ~~may~~shall request the relevant market surveillance authority or authorities to carry out an evaluation of compliance and follow the procedures referred to in Article 43 and paragraphs 1, 2 and 3 of this Article.

Amendment 279 #

Proposal for a regulation
Article 46 – paragraph 7

7. In ~~exceptional~~ circumstances which justify an immediate intervention to preserve the good functioning of the internal market and where the Commission has ~~sufficient~~ reasons to consider that the product referred to in paragraph 6 continues to present the risks referred to in paragraph 1 and no effective measures have been taken by the relevant national market surveillance authorities, the Commission ~~may~~shall request ENISA to carry out an evaluation of the risks presented by that product and shall inform the relevant market surveillance authorities accordingly. The relevant economic operators shall cooperate as necessary with ENISA.

Amendment 280 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 46 – paragraph 8

8. Based on ENISA’s evaluation referred to in paragraph 7, the Commission ~~may~~shall establish that a corrective or restrictive measure is necessary at Union level. To this end, it shall without delay consult the Member States concerned and the relevant operator or operators.

Amendment 281 #

Proposal for a regulation
Article 48 – paragraph 2

2. The Commission or ENISA ~~may~~shall propose joint activities for checking compliance with this Regulation to be conducted by market surveillance authorities based on indications or information of potential non-compliance across several Member States of products falling in the scope of this Regulation with the requirements laid down by the latter.

Amendment 282 #

Proposal for a regulation
Article 48 – paragraph 2

Amendment 283 #

Proposal for a regulation
Article 49 – paragraph 1

1. Market surveillance authorities mashall regularly decide to conduct simultaneous coordinated control actions (“sweeps”) of particular products with digital elements or categories thereof to check compliance with or to detect infringements to this Regulation.

Amendment 284 #

Proposal for a regulation
Article 49 – paragraph 2

2. Unless otherwise agreed upon by the market surveillance authorities involved, sweeps shall be coordinated by the Commission. The coordinator of the sweep ~~may~~shall, where appropriate, make the aggregated results publicly available.

Amendment 285 #

Proposal for a regulation
Article 49 – paragraph 3

3. ENISA ~~may~~shall identify, in the performance of its tasks, including based on the notifications received according to Article 11(1) and (2), categories of products for which sweeps ~~may~~shall be organised. The proposal for sweeps shall be submitted to the potential coordinator referred to in paragraph 2 for the consideration of the market surveillance authorities.

Amendment 286 #

Proposal for a regulation
Article 49 – paragraph 4

4. When conducting sweeps, the market surveillance authorities involved ~~may~~shall use the investigation powers set out Articles 41 to 47 and any other powers conferred upon them by national law.

Amendment 287 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Article 49 – paragraph 5

5. Market surveillance authorities ~~may~~ shall invite Commission officials, and other accompanying persons authorised by the Commission, to participate in sweeps.

Amendment 288 #

Proposal for a regulation
Article 49 a (new)

Article 49 a Provision of technical advice 1. The Commission shall appoint by way of an implementing act an expert group to provide technical advice to market surveillance authorities on matters related to the implementation and enforcement of this Regulation. The implementing act shall specify, inter alia, the details related to the composition of the group, its operation and the remuneration of its members. In particular, the expert group shall provide non-binding evaluations of products with digital elements upon request by a market surveillance authority that is conducting an investigation under Article 43 and of the list of critical products with digital elements set out in Annex II, as well as on the possible need to update that list. 2. The expert group shall consist of independent experts appointed for a renewable three-year term by the Commission on the basis of their scientific or technical expertise in the field. 3. The Commission shall appoint a number of experts which is deemed sufficient to fulfil the foreseen needs. 4. The Commission shall take the necessary measures to manage and prevent any conflicts of interest. The Declarations of interests of the members of the expert group shall be made publicly available. 5. The appointed experts shall perform their tasks with the highest level of professionalism, independence, impartiality and objectivity. 6. When adopting positions, views and reports, the expert group shall attempt to reach consensus. If consensus cannot be reached, decisions shall be taken by simple majority of the group members.

Amendment 289 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 52 – paragraph 1 – point a

(a) intellectual property rights~~, and confidential business information or trade secrets of a natural or legal person, including source code, except the cases referred to in Article 5 of~~ or trade secrets in line with Directive 2016/943 of the European Parliament and of the Council 36 ; __________________ 36 Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1).

Amendment 290 #

Proposal for a regulation
Article 53 – paragraph 3

3. The non-compliance with the essential cybersecurity requirements laid down in Annex I and the obligations set out in Articles 10 and 11 shall be subject to administrative fines of up to 1530 000 000 EUR or, if the offender is an undertaking, up to ~~2.5~~6 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher.

Amendment 291 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 53 – paragraph 4

4. The non-compliance with any other obligations under this Regulation shall be subject to administrative fines of up to 10 5 000 000 EUR or, if the offender is an undertaking, up to 2.5 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

Amendment 292 #

Proposal for a regulation
Article 53 – paragraph 6 – point a a (new)

(a a) the type of manufactured product and whether entity qualifies as microenterprise for the specific compliance regime outlined in the Article 10(-1) of this Regulation.

Amendment 293 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Article 53 – paragraph 6 – point c

(c) the size and market share of the operator committing the infringement., taking into account the scale of risks, consequences and financial specificities of micro, small and medium-sized enterprises

Amendment 294 #

Proposal for a regulation
Chapter VII a (new)

CHAPTER VIIa MEASURES IN SUPPORT OF INNOVATION: Article 53a Regulatory sandboxes 1. The Commission and ENISA, shall establish a European regulatory sandbox with voluntary participation of manufacturers of products with digital elements to: (a) provide for a controlled environment that facilitates the development, testing and validation of the design, development and production of products with digital elements, before their placement on the market or putting into service pursuant to a specific plan; (b) provide practical support to economic operators, including via guidelines and best practices to comply with the essential requirements set out in Annex I. (c) contribute to evidence-based regulatory learning.

Amendment 295 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 54 a (new)

Article 54 a Amendment to Directive 2020/1828/EC In Annex I to Directive 2020/1828/EC the following point is added: ‘67. [Regulation XXX][Cyber Resilience Act]’.

Amendment 296 #

Proposal for a regulation
Article 55 – paragraph 1

1. EU type-examination certificates and approval decisions issued regarding cybersecurity requirements for products with digital elements that are subject to other Union harmonisation legislation shall remain valid until [42 months after the date of entry into force of this Regulation], unless they expire ~~before~~after that date, or unless otherwise specified in other Union legislation, in which case they shall remain valid as referred to in that Union legislation.

Amendment 297 #

Proposal for a regulation
Article 55 – paragraph 3 a (new)

3 a. By way of derogation, for products with digital elements falling in scope of Regulation [Machinery Regulation proposal] or Regulation (EU) 167/2013 of the European Parliament and of the Council, the application date referred to Article 57 is extended by [36 months].

Amendment 298 #

Proposal for a regulation
Article 55 – paragraph 3 b (new)

3 b. By way of derogation for products with digital elements falling in scope of Regulation [Machinery Regulation proposal] or Regulation 2013/167, where the annual new sales in the EU of each type are fewer than [1000] units, the application date referred to Article 57 is extended by [60 months].

Amendment 299 #

Proposal for a regulation
Article 57 – paragraph 2

It shall apply from [2436 months after the date of entry into force of this Regulation]. However Article 11 shall apply from [124 months after the date of entry into force of this Regulation] and Articles 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38 shall apply from [30 months after the entry into force of this Regulation].

Amendment 300 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Article 57 – paragraph 2

It shall apply from ~~[24 months after the date of entry into force of this Regulation]. However Article 11 shall apply from~~ [12 months after the date of entry into force of this Regulation].

Amendment 301 #

Proposal for a regulation
Article 57 – paragraph 2

It shall apply from ~~[24 months after the date of entry into force of this Regulation]. However Article 11 shall apply from~~ [12 months after the date of entry into force of this Regulation].

Amendment 302 #

Proposal for a regulation
Article 57 – paragraph 2

It shall apply from [248 months after the date of entry into force of this Regulation]. However Article 11 shall apply from [12 months after the date of entry into force of this Regulation].

Amendment 303 #

Proposal for a regulation
Annex I – Part 1 – point 2

(2) Products with digital elements shall be delivered without any known critical or high severity exploitable vulnerabilities;

Amendment 304 #

Proposal for a regulation
Annex I – Part 1 – point 2

(2) Products with digital elements shall be delivered ~~without any known exploitable vulnerabilitie~~in a way that does not wilfully create cybersecurity risks;

Amendment 305 #

Proposal for a regulation
Annex I – Part 1 – point 3 – introductory part

(3) On the basis of the cybersecurity risk assessment referred to in Article 10(2) and where applicable, products with digital elements shall: (aa) be placed on the market without any known exploitable vulnerabilities towards an external device or network;

Amendment 306 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point a

(a) be delivered with a secure by default configuration~~, including the possibility to reset the product to its original state~~;

Amendment 307 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point a

(a) be delivered with a secure by default configuration, including the possibility to reset the product to its ~~original state~~default security configuration;

Amendment 308 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point a a (new)

(a a) be placed on the market with functional separation of security updates from functionality updates, to allow automatic installation of security updates, with a clear and easy-to-use opt-out mechanism, and preserve user choice on functionalities unless technically unfeasible;

Amendment 309 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point c

(c) protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encryptingon, tokenization, compensating controls or other adequate protection of relevant data at rest or in transit by state of the art mechanisms;

Amendment 310 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point c

(c) protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, ~~such as by~~ encrypting relevant data at rest or in transit by state of the art mechanisms, and by using other technical means;

Amendment 311 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point d

(d) protect the integrity of stored, transmitted or otherwise processed data, personal or other, commands, programs and configuration against any manipulation or modification not authorised by the user, as well as report on corruptions or possible unauthorised access;

Amendment 312 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point f

(f) protect the availability of essential and basic functions, including the resilience against and mitigation of denial of service attacks;

Amendment 313 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point i

(i) be designed, developed and produced to reduce the impact of an significant incident using appropriate exploitation mitigation mechanisms and techniques;

Amendment 314 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point j

(j) provide security related information by providing at user request recording and/or monitoring capabilities, locally and at device level for relevant internal activity, including the access to or modification of data, services or functions;

Amendment 315 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point k

(k) ensure that vulnerabilities can be addressed through security updates, including, where applicable, separate from functionality updates and through automatic updates and the notification of available updates to users.

Amendment 316 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point k

(k) ensure that vulnerabilities can be addressed through ~~security updates, including, where applicable, through automatic~~dedicated security updates and the notification of available updates to users.

Amendment 317 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point k a (new)

(k a) be designed, developed and produced in order to allow for its secure discontinuation and potential recycling when reaching the end of the life cycle, including by allowing users to securely withdraw and remove all data on a permanent basis;

Amendment 318 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 2

(2) in relation to the risks posed to the products with digital elements, address and remediate critical and high vulnerabilities without delay, including by providing security updates or document the reasons for not remediating the vulnerability;

Amendment 319 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 4

(4) once a security update has been made available, publically or according to industry best practice disclose information about fixed known vulnerabilities, including a description of the vulnerabilities, information allowing users to identify the product with digital elements affected, the impacts of the vulnerabilities, their severity and information helping users to remediate the vulnerabilities;

Amendment 320 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 4

(4) once a security update has been made available, publically disclose information about fixed vulnerabilities, including a description of the vulnerabilities, information allowing users to identify the product with digital elements affected, the impacts of the vulnerabilities, their severity and clear and accessible information helping users to remediate the vulnerabilities;

Amendment 321 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 4 a (new)

(4 a) Information regarding fixes and vulnerabilities is shared and disclosed in a controlled way, respecting principles of ‘harm reduction’ and trade secrets through responsible disclosure of vulnerabilities to the actors who can act to mitigate the vulnerability, and that it is not made publicly available to avoid the risk of inadvertently informing potential attackers;

Amendment 322 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 7

(7) provide for mechanisms to securely distribute security updates for products with digital elements to ensure that exploitable vulnerabilities are fixed or mitigated in a timely manner;

Amendment 323 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 8

(8) ensure that, where security patches or updates arcan reasonably be made available to address identified security issues, theyre is a means by which users can obtain them are disseminated without delay and free of charge or at a transparent and non-discriminatory cost, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken.

Amendment 324 #

Proposal for a regulation
Annex II – paragraph 1 – point 2

2. the single point of contact where information about cybersecurity vulnerabilities of the product can be reported and received;

Amendment 325 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Annex II – paragraph 1 – point 6

6. if and, where applicable, where the software bill of materials can be accessed by the competent authorities;

Amendment 326 #

Proposal for a regulation
Annex II – paragraph 1 – point 6

6. ~~if and,~~ where applicable, where the software bill of materials can be accessed;

Amendment 327 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI

Proposal for a regulation
Annex II – paragraph 1 – point 8

8. the type of technical security support offered by the manufacturer and until when it will be provided~~, at the very least until when users can expect to receive security updates~~;

Amendment 328 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI

Proposal for a regulation
Annex II – paragraph 1 – point 8 a (new)

8 a. the expected product lifetime end- date, clearly displaying, where applicable, on the packaging of the product, until when the manufacturer shall ensure the effective handling of vulnerabilities and provision of security updates;

Amendment 329 #

Proposal for a regulation
Annex II – paragraph 1 – point 9 – point a

~~(a) the necessary measures during initial commissioning and throughout the lifetime of the product to ensure its secure use;~~deleted

Amendment 330 #

Proposal for a regulation
Annex II – paragraph 1 – point 9 – point b

~~(b) how changes to the product can affect the security of data;~~deleted

Amendment 331 #

Proposal for a regulation
Annex II – paragraph 1 – point 9 – point c a (new)

(c a) the expected product lifetime and until when the manufacturer ensures the effective handling of vulnerabilities and provision of security updates;

Amendment 332 #

Proposal for a regulation
Annex II – paragraph 1 – point 9 – point d

~~(d) the secure decommissioning of the product, including information on how user data can be securely remov~~deleted.

Amendment 333 #

Proposal for a regulation
Annex III – Part I – point 3 a (new)

3 a. Authentication, Authorization and Accounting (AAA) platforms;

Amendment 334 #

Proposal for a regulation
Annex III – Part I – point 15

15. Physical and virtual network interfaces;

Amendment 335 #

Proposal for a regulation
Annex III – Part I – point 18

~~18. Routers, modems intended for the connection to the internet, and switches, not covered by class II;~~deleted

Amendment 336 #

Proposal for a regulation
Annex III – Part I – point 23

23. Industrial products with digital elements that can be referred as part of Internet of Things not covered by class II.

Amendment 337 #

Proposal for a regulation
Annex III – Part II – point 4

4. Firewalls, security gateways, intrusion detection and/or prevention systems intended for industrial use;

Amendment 338 #

Proposal for a regulation
Annex III – Part II – point 7

7. Routers, modems intended for the connection to the internet, ~~and~~ switches, ~~intended for industrial us~~and other network nodes that are necessary for the provision of the connectivity service;

Amendment 339 #

Proposal for a regulation
Annex III – Part II – point 15 a (new)

15 a. Smart home products, including smart home servers and virtual assistants;

Amendment 340 #

Proposal for a regulation
Annex III – Part II – point 15 b (new)

15 b. Smart security devices, including smart door locks, cameras and alarm systems;

Amendment 341 #

Proposal for a regulation
Annex III – Part II – point 15 c (new)

15 c. Smart toys and similar devices likely to interact with children;

Amendment 342 #

Proposal for a regulation
Annex III – Part II – point 15 d (new)

15 d. Personal health appliances and wearables.

Amendment 343 #

Proposal for a regulation
Annex V – paragraph 1 – point 1 – point a

~~(a) its intended purpose;~~deleted

Amendment 344 #

Proposal for a regulation
Annex V – paragraph 1 – point 2

2. a description of the design, development and production of the product and vulnerability handling processes, including: (a) complete information on the design and development of the product with digital elements, including, where applicable, drawings and schemes and/or a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing; (b) specifications of the vulnerability handling processes put in place by the manufacturer, including the software bill of materials, the coordinated vulnerability disclosure policy, evidence of the provision of a contact address for the reporting of the vulnerabilities and a description of the technical solutions chosen for the secure distribution of updates; (c) specifications of the production and monitoring processes of the product with digital elements and the validation of these processes.deleted complete information and complete information and

Amendment 345 #

Proposal for a regulation
Annex V – paragraph 1 – point 2 – point a

(a) complete information on the design and development of the product with digital elements, including, where applicable, drawings and schemes and/or a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing;deleted

Amendment 346 #

Proposal for a regulation
Annex V – paragraph 1 – point 3

3. an statement or a summary of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained as laid down in Article 10 of this Regulation and, further to a reasoned request from a market surveillance authority, provided that it is necessary in order for this authority to be able to check compliance with the essential requirements set out in Annex I, a detailed assessment of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained as laid down in Article 10 of this Regulation;

Amendment 347 #

Proposal for a regulation
Annex V – paragraph 1 – point 3

3. a~~n assess~~ statement of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained as laid down in Article 10 of this Regulation;

Amendment 57 #

Proposal for a regulation
Recital 7

(7) Under certain conditions, all products with digital elements integrated in or connected to a larger electronic information system can serve as an attack vector for malicious actors. As a result, even hardware and software considered as less critical can facilitate the initial compromise of a device or network, enabling malicious actors to gain privileged access to a system or move laterally across systems. Manufacturers should therefore ensure that all ~~connectable~~ products with digital elements connected to an external network or device are designed and developed in accordance with essential requirements laid down in this Regulation. This includes both products that can be connected to external networks or device physically via hardware interfaces and products that are connected logically, such as via network sockets, pipes, files, application programming interfaces or any other types of software interface. As cybersecurity threats can propagate through various products with digital elements before reaching a certain target, for example by chaining together multiple vulnerability exploits, manufacturers should also ensure the cybersecurity of those products that are only indirectly connected to other devices or networks.

Amendment 58 #

Proposal for a regulation
Recital 7 a (new)

(7 a) This Regulation should not apply to the internal networks of a product with digital elements if these networks have dedicated endpoints and are secured from external data connection.

Amendment 59 #

Proposal for a regulation
Recital 7 b (new)

(7 b) This Regulation should not apply to spare parts intended solely to replace defective parts of products with digital elements, in order to restore their functionality.

Amendment 60 #

Proposal for a regulation
Recital 9

(9) This Regulation ensures a high level of cybersecurity of products with digital elements~~. It does not regulate services, such as Software-as-a-Service (SaaS), except for~~, processes and ancillary services. The definition and regulatory scope for products with digital elements should also include remote data processing solutions ~~relating to a~~which are necessary for products with digital elements ~~understood as any data processing at a distance for which~~to perform their functions. Remote data processing solutions should be understood as any data processing at a distance, irrespective of whether data is processed or stored locally on the device of the user or remotely. Moreover, manufacturers shall remain responsible for the software which is designed and developed, as well as customised or substantially modified by the manufacturer of the product concerned or under the control or responsibility of that manufacturer, and the absence of which would prevent such a product with digital elements from performing one of its functions. Software-as-a-Service (SaaS) shall constitute remote data processing solutions within the meaning of this Regulation to the extent that is inextricably linked to the performing one the product functions. For instance, websites or cloud service models supporting the functionality of products with digital elements fall in the scope of this Regulation. [Directive XXX/XXXX (NIS2)] puts in place cybersecurity and incident reporting requirements for essential and important entities, such as critical infrastructure, with a view to increasing the resilience of the services they provide. [Directive XXX/XXXX (NIS2)] applies to cloud computing services and cloud service models, such as SaaS. All entities providing cloud computing services in the Union that meet or exceed the threshold for medium-sized enterprises fall in the scope of that Directive. Where the manufacturer employs such cloud solutions which are not covered by NIS 2 or uses a custom implementation of a cloud service model, the requirements in this Regulation should be applicable.

Amendment 61 #

Proposal for a regulation
Recital 9

(9) This Regulation ensures a high level of cybersecurity of products with digital elements. It does not regulate services, such as Software-as-a-Service (SaaS), except for remote data processing solutions relating to a product with digital elements understood as any data processing at a distance for which the software is designed and developed by the manufacturer of the product concthat fall into one or more of the following data processing services models: Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), Software-as-a-Service (SaaS). Those service delivery models represent a specific, pre-packaged combination of IT resources offerned ~~or under the responsibility of that manufacturer, and the absence of which would prevent such a product with digital elements from performing~~ by a provider of data processing service. Three base cloud delivery models are further completed by emerging variations, each comprised of a distinct combinatione of ~~its function~~IT resources. [Directive XXX/XXXX (NIS2)] puts in place cybersecurity and incident reporting requirements for essential and important entities, such as critical infrastructure, with a view to increasing the resilience of the services they provide. [Directive XXX/XXXX (NIS2)] applies to cloud computing services and cloud service models, such as IaaS, PaaS and SaaS. All entities providing cloud computing services in the Union that meet or exceed the threshold for medium-sized enterprises fall in the scope of that Directive.

Amendment 62 #

Proposal for a regulation
Recital 9 a (new)

(9 a) Software and data that are openly shared and where users can freely access, use, modify and redistribute them or modified versions thereof, can contribute to research and innovation in the market. Research by the Commission also shows that free and open-source software can contribute between €65 billion to €95 billion to the Union’s GDP and that it can provide significant growth opportunities for the European economy. Users are allowed to run, copy, distribute, study, change and improve software and data, including models by way of free and open- source licences. To foster the development and deployment of free and open source software, especially by SMEs, start-ups, non-profits, academic research but also by individuals, this Regulation should not apply to such free and open-source software components, except in very specific cases. We must take into account the fact that different development models of software distributed and developed under public licences exist, having a wide range of different roles in such development models. Developers of free and open-source software components should not be mandated under this Regulation to comply with requirements targeting the product value chain and, in particular, not towards the manufacturer that has used that free and open-source software component in a commercial product. Developers of free and open- source software components, as well as all manufacturers that are not subject to stricter compliance rules, should however be encouraged to implement the provisions of Annex I, as a way to increase security, allowing the promotion of trustworthy products with digital elements in the Union.

Amendment 63 #

Proposal for a regulation
Recital 10

(10) In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributableSoftware and data that are openly shared and where users can freely access, use, modify and redistribute them or modified versions thereof, can contribute to research and innovation in the market. Research by the Commission also shows that free and open-source software can contribute between €65 billion to €95 billion to the Union’s GDP and that it can provide significant growth opportunities for the European economy. In order not to hamper innovation or research, only free and open-source software supplied in the course of a commercial activity should be covered by this Regulation. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services when this does not serve only the recuperation of actual costs or pursues a profit or the intention to monetise, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. Neither the collaborative development of free and open-source software components nor making them available on open repositories should constitute a placing on the market or putting into service. The circumstances under which the product has been developed, or how the development has been financed should not be taken into account when determining the commercial or non-commercial nature of that activity.

Amendment 64 #

Proposal for a regulation
Recital 10

(10) In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. Nonetheless, in order to ensure that individual or micro developers of software as defined in Commission Recommendation 2003/361/EC do not face major financial obstacles and are not discouraged from testing the proof of concept as well as the business case on the market, these entities shall be required to make best efforts in order to comply with the requirements in this proposal during the 18 months from placing a software on the market. This special regime will prevent the chilling effect of high compliance and entry costs could have on entrepreneurs or skilled individuals who consider developing software in the Union.

Amendment 65 #

Proposal for a regulation
Recital 10

(10) In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source codNeither the collaborative development of free and open-source software components nor making them available on open repositories should constitute a placing on the market or putting into service. As such, most package man~~d modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might~~agers, code hosting, and collaboration platforms do not make software products available on the market as distributors within this Regulation. A commercial activity, within the understanding of making available on the market, might however be characterizsed ~~not only~~ by charging a price for a ~~product, but also by~~free and open- source software component, but also by monetisation like charging a price for technical support services, paid software updates, by providing a software platform through which the ~~manufactur~~provider monetises ~~other services~~software (such as an App Store), or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. Unrelated consulting services, membership fees and not for profit sponsorships do not constitute monetisation within the scope of this Regulation. When open-source software is integrated into a final product with digital elements that is placed on the market, the economic operator that has placed the final product with digital elements on the market shall be responsible for the compliance of the product including of the free and open-source components.

Amendment 66 #

Proposal for a regulation
Recital 10

(10) IResearch by the Commission shows that Open Source software contributes between €65 billion to €95billion to the Union’s GDP, and provides significant growth opportunities for the Union economy. Therefore, in order not to hamper innovation or research, freeware and open-source software ~~developed or~~ supplied outside the course of a commercial activity should not be covered by this Regulation. ~~This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable.~~ In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform th~~rough~~e core functionality of which relies on other services which the manufacturer monetises ~~other services~~, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software.

Amendment 67 #

Proposal for a regulation
Recital 10 a (new)

(10 a) Due to the permissive nature of open-source licences, open-source software can be used as a component in products without need for the consent or knowledge of the original author, allowing for manufacturers to build new products and services quickly, however open-source software developers are not compensated for this use and often work on the software in their free time. Therefore, when a manufacturer uses open-source software as a component in a product, they should be subject to the obligations of manufacturers for that component, unless otherwise agreed through the provision of commercial technical support either by the developer or a third-party.

Amendment 68 #

Proposal for a regulation
Recital 10 a (new)

(10 a) Free and open-source software is developed, maintained, and distributed via online platforms. In contrast to app stores that make products available, these entities play an important research and development role. As such, package managers, code hosting, and collaboration platforms do not make software products available on the market as distributors within this Regulation.

Amendment 69 #

Proposal for a regulation
Recital 10 b (new)

(10 b) Public open-source code and software repositories allow developers to access a wide range of resources for software development, and allow for developers to share their code with the wider open-source community. These repositories operate as a public good, and therefore should not be considered as providers, manufacturers, importers or distributors, nor should their activity be considered as commercial within the meaning of this Regulation.

Amendment 70 #

Proposal for a regulation
Recital 11 a (new)

(11 a) According to the WTO Agreement on Technical Barriers to Trade, when technical regulations are necessary and relevant international standards exist, WTO Members should use those standards as the basis for their own technical regulations. It is important to avoid duplication of work among standardisation organizations, as international standards are intended to facilitate the harmonization of national and regional technical regulations and standards, thereby reducing non-tariff technical barriers to trade. Given that cybersecurity is a global issue, the Union should strive for maximum alignment. To achieve this objective, the standardization request for this Regulation, as set out in Article 10 of Regulation 1025/2012, should seek to reduce barriers to the acceptance of standards by publishing their references in the Official Journal of the EU, in accordance with Article 10 (6) of Regulation 1025/2012.

Amendment 71 #

Proposal for a regulation
Recital 11 b (new)

(11 b) Considering the broad scope of this Regulation, the timely development of harmonised standards poses a significant challenge. To enhance the security of products with digital components in the Union market as soon as possible, the Commission should be empowered for a limited time to declare existing international standards for cyber security of products as satisfying the requirements of this Regulation. These standards should be published as standards providing presumption of conformity.

Amendment 72 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Recital 13 a (new)

(13 a) Agricultural and forestry vehicles in scope of Regulation (EU) 167/2013 of the European Parliament and of the Council fall also in the scope of this Regulation. In order to avoid regulatory overlaps, additional cybersecurity requirements in future amendments of Regulation (EU) 167/2013 should not be foreseen.

Amendment 73 #

Proposal for a regulation
Recital 16 a (new)

(16 a) Without prejudice to the rules set out in Directive 85/374/EEC, manufacturers should also be liable for the damages suffered by consumers that are caused by their infringement of the legal obligations and cybersecurity requirements set out in this Regulation. Such compensation should be in accordance with the rules and procedures set out in the applicable national law and without prejudice to other possibilities for redress available under consumer protection rules.

Amendment 74 #

Proposal for a regulation
Recital 19

(19) Certain tasks provided for in this Regulation should be carried out by ENISA, in accordance with Article 3(2) of Regulation (EU) 2019/881. In particular, ENISA should receive notifications from manufacturers of actively exploited vulnerabilities contained in products with digital elements, as well as incidents having an impact on the security of those products. ENISA should also forward these notifications to the relevant Computer Security Incident Response Teams (CSIRTs) or, respectively, to the relevant single points of contact of the Member States designated in accordance with Article [Article X] of Directive [Directive XXX / XXXX (NIS2)], and inform the relevant market surveillance authorities about the notified vulnerability. On the basis of the information it gathers, ENISA should prepare a biennial technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group referred to in Directive [Directive XXX / XXXX (NIS2)]. Furthermore, considering its expertise and mandate, ENISA should be able to support the process for implementation of this Regulation. In particular, it should be able to propose joint activities to be conducted by market surveillance authorities based on indications or information regarding potential non-compliance with this Regulation of products with digital elements across several Member States or identify categories of products for which simultaneous coordinated control actions should be organised. In exceptional circumstances, at the request of the Commission, ENISA should be able to conduct evaluations in respect of specific products with digital elements that present a significant cybersecurity risk, where an immediate intervention is required to preserve the good functioning of the internal market. ENISA should publish and maintain a known exploited vulnerability catalogue, as an authoritative source of vulnerabilities exploited. Manufacturers should monitor the catalogue and notify any listed vulnerability found in their product. Active exploitation in this context does not include scanning, security research exploits or Proofs of Concept.

Amendment 75 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN, Stéphanie YON-COURTIN, Sandro GOZI

Proposal for a regulation
Recital 19

(19) Certain tasks provided for in this Regulation should be carried out by ~~ENISA, in accordance with Article 3(2) of Regulation (EU) 2019/881~~the relevant Computer Security Incident Response Teams (CSIRTs) or the relevant market surveillance authority. In particular, ~~ENISA~~CSIRTs should receive notifications from manufacturers of actively exploited vulnerabilities ~~contained i~~having a significant impact on products with digital elements, as well as incidents having an significant impact on the security of those products. ENISA should also forward these notifications to the relevant Computer Security Incident Response Teams (CSIRTs) or, respectively, to the relevant single points of contact of the Member States designated in accordance with Article [Article X] of Directive [Directive XXX / XXXX (NIS2)], and inCSIRTs or the relevant market surveillance authority, should submit to ENISA information on notifications provided such information is relevant for the coordinated response to large-scale cybersecurity incidents. For the purpose of this Regulation, an incident shall be considered to be significant if (i) it has caused or is capable of causing severe operational disruption of the production or the development, build and distribution environment form the ~~relevant market surveillance authorities about~~ manufacturer concerned, that would impact the security of a product; or (ii) it has affected or is capable of affecting other n~~otified vulnerability~~atural or legal persons by causing considerable material or non-material damage. On the basis of the information it gathers, ENISA should prepare a biennial technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group referred to in Directive ~~[Directive XXX / XXXX (NIS2)]~~(EU) 2022/2555. Furthermore, considering its expertise and mandate, ENISA should be able to support the process for implementation of this Regulation. In particular, it should be able to propose joint activities to be conducted by market surveillance authorities based on indications or information regarding potential non-compliance with this Regulation of products with digital elements across several Member States or identify categories of products for which simultaneous coordinated control actions should be organised. In exceptional circumstances, at the request of the Commission, ENISA should be able to conduct evaluations in respect of specific products with digital elements that present a significant cybersecurity risk, where an immediate intervention is required to preserve the good functioning of the internal market.

Amendment 76 #

Proposal for a regulation
Recital 20

(20) Products with digital elements should bear the CE marking to visibly, legibly and indelibly indicate their conformity with this Regulation so that they can move freely within the internal market. Member States should not create unjustified obstacles to the placing on the market of products with digital elements that comply with the requirements laid down in this Regulation and bear the CE marking.

Amendment 77 #

Proposal for a regulation
Recital 22

(22) In order to ensure that products with digital elements, when placed on the market, do not pose cybersecurity risks to persons and organisations, essential requirements should be set out for such products. When the products are subsequently modified, by physical or digital means, in a way that ~~is not foreseen by the manufacturer and that may imply that they no longer meet the relevant essential requirements~~materially alters the core function of a product, the modification should be considered as substantial. For example, software updates or repairs could be assimilated to maintenance operations provided that they do not modify a product already placed on the market in such a way that compliance with the applicable requirements may be affected, or that the intended use for which the product has been assessed may be changed. As is the case for physical repairs or modifications, a product with digital elements should be considered as substantially modified by a software change where the software update modifies the original intended functions, type or performance of the product and these changes were not foreseen in the initial risk assessment, or the nature of the hazard has changed or the level of risk has increased because of the software updateintroduce substantial changes to the functions or cybersecurity architecture of a product already placed on the market, that change the level of hazard or risk for which the product was assessed.

Amendment 78 #

Proposal for a regulation
Recital 22

(22) In order to ensure that products with digital elements, when placed on the market, do not pose cybersecurity risks to persons and organisations, essential requirements should be set out for such products. When the products are subsequently modified, by physical or digital means, in a way that is not foreseen by the manufacturer and that may imply that they no longer meet the relevant essential requirements, the modification should be considered as substantial. For example, software updates or repairs could be assimilated to maintenance operations provided that they do not modify a product already placed on the market in such a way that compliance with the applicable requirements may be affected~~, or that the intended use for which the product has been assessed may be changed~~. As is the case for physical repairs or modifications, a product with digital elements should be considered as substantially modified by a software change where the software update modifies the original intended functions, type or performance of the product and these changes were not foreseen in the initial risk assessment, or the nature of the hazard has changed or the level of risk has significantly increased because of the software update.

Amendment 79 #

Proposal for a regulation
Recital 22

(22) In order to ensure that products with digital elements, when placed on the market, do not pose cybersecurity risks to persons and organisations, essential requirements should be set out for such products. When the products are subsequently modified, by physical or digital means, in a way that is not foreseen by the manufacturer and that may imply that they no longer meet the relevant essential requirements, the modification should be considered as substantial. For example, software updates or repairs such as minor adjustment of the source code that can improve the security and functioning, could be assimilated to maintenance operations provided that they do not modify a product already placed on the market in such a way that compliance with the applicable requirements may be affected, or that the intended use for which the product has been assessed may be changed. As is the case for physical repairs or modifications, a product with digital elements should be considered as substantially modified by a software change where the software update modifies the original intended functions, type or performance of the product and these changes were not foreseen in the initial risk assessment, or the nature of the hazard has changed or the level of risk has increased because of the software update.

Amendment 80 #

Proposal for a regulation
Recital 23

(23) In line with the commonly established notion of substantial modification for products regulated by Union harmonisation legislation, whenever a substantial modification occurs that may affect the compliance of a product with this Regulation or when the intended purpose of that product changes, , it is appropriate that the compliance of the product with digital elements is verified and that, where applicable, ~~it undergoes a new~~the conformity assessment is updated. Where applicable, if the manufacturer undertakes a conformity assessment involving a third party, changes that might lead to substantial modifications should be notified to the third party. Should a substantial modification be deemed to occur, the update to the conformity assessment should focus solely on the aspects of the assessment affected by the modification.

Amendment 81 #

Proposal for a regulation
Recital 23

(23) In line with the commonly established notion of substantial modification for products regulated by Union harmonisation legislation, whenever a substantial modification occurs that may affect the compliance of a product with this Regulation ~~or when the intended purpose of that product changes~~, it is appropriate that the compliance of the product with digital elements is verified and that, where applicable, ~~it undergoes a new~~the conformity assessment updated. Where applicable, if the manufacturer undertakes a conformity assessment involving a third party, changes that might lead to substantial modifications should be notified to the third party. The subsequent conformity assessment should address the changes that lead to the new assessment, unless these changes have significant impact on the conformity of other parts of the product.

Amendment 82 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Recital 24 a (new)

(24 a) Manufacturers of products with digital elements should ensure that software updates are provided in a clear and transparent way and clearly differentiate between security and functionality updates. Whilst security updates are designed to decrease the level of risk of a product with digital elements, the uptake of functionality updates provided by the manufacturer should always remain a user choice. Manufacturers should therefore provide these updates separately, unless technically unfeasible. Manufacturers should provide consumers with adequate information on the reasons behind each update and its foreseen impact on the product, as well as a clear and easy-to-use opt-out mechanism.

Amendment 83 #

Proposal for a regulation
Recital 24 a (new)

(24 a) Manufacturers should clearly differentiate between security and functionality updates, and ensure that they are provided separately in a clear and transparent way. Manufacturers should therefore provide these updates separately, unless technically unfeasible. Manufacturers should provide consumers with adequate information on the motive behind each update and its foreseen impact on the product, as well as a clear and easy-to-use opt-out mechanism.

Amendment 84 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Recital 25

(25) Products with digital elements should be considered critical if the negative impact of the exploitation of potential cybersecurity vulnerabilities in the product can be severe due to, amongst others, the cybersecurity-related functionality, or the intended use or the size of market penetration of a particular product. . In particular, vulnerabilities in products with digital elements that have a cybersecurity- related functionality, such as secure elements, can lead to a propagation of security issues throughout the supply chain or society. The severity of the impact of a cybersecurity incident may also increase when taking into account the intended use of the product, such as in an industrial setting or in the context of an essential entity of the type referred to in Annex [Annex I] to Directive [Directive XXX/ XXXX (NIS2)], or for the performance of critical or sensitive functions, ~~such as processing of personal data~~impacting health, safety or fundamental rights.

Amendment 85 #

Proposal for a regulation
Recital 25

(25) Products with digital elements should be considered critical if the negative impact of the exploitation of potential cybersecurity vulnerabilities in the product can be severe due to, amongst others, the cybersecurity-related functionality, or the intended use or the reasonably foreseen misuse caused by a cyberattack. In particular, vulnerabilities in products with digital elements that have a cybersecurity- related functionality, such as secure elements, can lead to a propagation of security issues throughout the supply chain. The severity of the impact of a cybersecurity incident may also increase when taking into account the intended use of the product, such as in an industrial setting or in the context of an essential entity of the type referred to in Annex [Annex I] to Directive [Directive XXX/ XXXX (NIS2)], or for the performance of critical or sensitive functions, such as processing of personal data.

Amendment 86 #

Proposal for a regulation
Recital 26

(26) Critical products with digital elements should be subject to stricter conformity assessment procedures, while keeping a proportionate approach. For this purpose, critical products with digital elements should be divided into two classes, reflecting the level of cybersecurity risk linked to these categories of products. A potential cyber incident involving products in class II might lead to greater negative impacts than an incident involving products in class I, for instance due to the nature of their cybersecurity-related function or intended use in ~~sensitive~~ environments of high criticality, and therefore should undergo a stricter conformity assessment procedure.

Amendment 87 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Recital 28

(28) This Regulation addresses cybersecurity risks in a targeted manner. Products with digital elements might, however, pose other safety risks, that are not always related to cybersecurity but can be a consequence of a security breach. Those risks should continue to be regulated by other relevant Union product legislation as a rule if a higher level of protection is conferred. If not, safety risks in connection with the cybersecurity functions of products with digital elements should fall within the scope of this Regulation. If no other Union harmonisation legislation is applicable, they should be subject to Regulation [General Product Safety Regulation]. Therefore, in light of the targeted nature of this Regulation, as a derogation from Article 2(1), third subparagraph, point (b), of Regulation [General Product Safety Regulation], Chapter III, Section 1, Chapters V and VII, and Chapters IX to XI of Regulation [General Product Safety Regulation] should apply to products with digital elements with respect to safety risks not covered by this Regulation, if those products are not subject to specific requirements imposed by other Union harmonisation legislation within the meaning of [Article 3, point (25) of the General Product Safety Regulation].

Amendment 88 #

Proposal for a regulation
Recital 28

(28) This Regulation addresses cybersecurity risks in a targeted manner~~. Products with digital elements might, however, pose other safety risks, that~~, including other risks related to their intended use or reasonably foreseen misuse of products with digital elements caused by a cyberattack. Therefore, safety risks related to the cybersecurity functions of products with digital elements shall fall within the scope of this Regulation. Other risks which are not related to cybersecurity~~. Those risks~~ should continue to be regulated by other relevant Union product legislation. If no other Union harmonisation legislation is applicable, they should be subject to Regulation [General Product Safety Regulation]. Therefore, in light of the targeted nature of this Regulation, as a derogation from Article 2(1), third subparagraph, point (b), of Regulation [General Product Safety Regulation], Chapter III, Section 1, Chapters V and VII, and Chapters IX to XI of Regulation [General Product Safety Regulation] should apply to products with digital elements with respect to safety risks not covered by this Regulation, if those products are not subject to specific requirements imposed by other Union harmonisation legislation within the meaning of [Article 3, point (25) of the General Product Safety Regulation].

Amendment 89 #

Andreas SCHWAB, Deirdre CLUNE

Proposal for a regulation
Recital 29

(29) Products with digital elements classified as high-risk AI systems according to Article 6 of Regulation27 [the AI Regulation] which fall within the scope of this Regulation should comply with the essential requirements set out in this Regulation. When those high-risk AI systems fulfil the essential requirements of this Regulation, they should be deemed compliant with the cybersecurity requirements set out in Article [Article 15] of Regulation [the AI Regulation] in so far as those requirements are covered by the EU declaration of conformity or parts thereof issued under this Regulation. As regards the conformity assessment procedures relating to the essential cybersecurity requirements of a product with digital elements covered by this Regulation and classified as a high-risk AI system, the relevant provisions of Article 43 of Regulation [the AI Regulation] should apply as a rule instead of the respective provisions of this Regulation. ~~However, t~~This rule should ~~not result in reducing the necessary~~create a high level of assurance for critical products with digital elements covered by this Regulation. ~~Therefore, by way of derogation from this rule,~~For high- risk AI systems that fall within the scope of ~~the Regulation~~ [the AI Regulation] and are also qualified as critical products with digital elements ~~pursuant to~~under this Regulation ~~and to which the conformity assessment procedure based on internal control referred to in Annex VI of the Regulation [the AI Regulation] applies, should be subject to~~, the responsible sectoral notified body should be responsible for conducting the conformity assessment ~~provisions of~~under this Regulation in so far as the essential requirements of this Regulation are concerned. In this case, for all the other aspects covered by Regulation [the AI Regulation] the respective provisions on conformity assessment based on internal control set out in Annex VI to Regulation [the AI Regulation] should appland lead the administrative process such that economic operators can address their request for conformity assessment to a single regulatory body. __________________ 27 Regulation [the AI Regulation].

Amendment 90 #

Adriana MALDONADO LÓPEZ, Maria-Manuel LEITÃO-MARQUES, Marc ANGEL, Maria GRAPINI, Brando BENIFEI

Proposal for a regulation
Recital 30

Amendment 91 #

Proposal for a regulation
Recital 30

(30) The machinery products falling within the scope of Regulation [Machinery Regulation proposal] which are products with digital elements within the meaning of this Regulation and for which a declaration of conformity has been issued on the basis of this Regulation should be deemed to be in conformity with the essential health and safety requirements set out in [Annex III, sections 1.1.9 and 1.2.1] of the Regulation [Machinery Regulation proposal], as regards protection against corruption and safety and reliability of control systems in so far as the compliance with those requirements is demonstrated by the EU declaration of conformity issued under this Regulation without prejudice to products with digital elements, which are also machinery products that fall within the categories listed in Annex I of Regulation [Machinery Regulation proposal], being subject to the specific conformity assessment procedure as required by Article 21(2) and (3) of Regulation [Machinery Regulation proposal].

Amendment 92 #

Proposal for a regulation
Recital 31

(31) Regulation [European Health Data Space Regulation proposal] complements the essential requirements laid down in this Regulation. The electronic health record systems (‘EHR systems’) falling under the scope of Regulation [European Health Data Space Regulation proposal] which are products with digital elements within the meaning of this Regulation should therefore also comply with the essential requirements set out in this Regulation~~. T~~ and their manufacturers should demonstrate conformity as required by ~~Regulation [European Health Data Space~~this Regulation ~~proposal]~~. To facilitate compliance, manufacturers may draw up a single technical documentation containing the elements required by both legal acts. ~~As this Regulation does not cover SaaS as such, EHR systems offered through the SaaS licensing and delivery model are not within the scope of this Regulation. Similarly,~~ EHR systems that are developed and used in-house are not within the scope of this Regulation, as they are not placed on the market.

Amendment 93 #

Proposal for a regulation
Recital 32

(32) In order to ensure that products with digital elements are secure both at the time of their placing on the market as well as throughout their life-cycle, it is necessary to lay down essential requirements for vulnerability handling and essential cybersecurity requirements relating to the properties of products with digital elements. While manufacturers should comply with all essential requirements related to vulnerability handling ~~and ensure that all their products are delivered without any known exploitable vulnerabilities~~, they should determine which ~~other~~ essential requirements related to the product properties are relevant for the concerned type of product. For this purpose, manufacturers should undertake an assessment of the cybersecurity risks associated with a product with digital elements to identify relevant risks and relevant essential requirements and in order to appropriately apply suitable harmonised standards or common specifications. Products with digital elements shall be either placed on the market delivered without any known critical or high severity exploitable vulnerabilities or manufacturers shall provide based on a risk assessment the appropriate impact mitigation such as by security updates before the product is put into service for the first time.

Amendment 94 #

Proposal for a regulation
Recital 32

(32) In order to ensure that products with digital elements are secure both at the time of their placing on the market as well as throughout their life-cycle, it is necessary to lay down essential requirements for vulnerability handling and essential cybersecurity requirements relating to the properties of products with digital elements. While manufacturers should comply with all essential requirements related to vulnerability handling and ensure that all their products are delivered without any known exploitable vulnerabilities, they should determine which other essential requirements related to the product properties are relevant for the concerned type of product. For this purpose, manufacturers should undertake an assessment of the cybersecurity risks associated with a product with digital elements to identify relevant risks and relevant essential requirements and in order to appropriately apply suitable harmonised standards ~~or common specifications~~.

Amendment 95 #

Proposal for a regulation
Recital 32 a (new)

(32 a) In order to ensure the products are designed, developed and produced in line with essential requirements foreseen in Section 1 of Annex I, manufacturers should exercise due diligence when integrating components sourced from third parties in products with digital elements. Given that such components are tailored to and integrated taken into account the specificities of the product, in particular in the case of free and open source software that have not been placed on the market in exchange of financial or other type of monetisation, the manufacturer of the product shall be responsible for ensuring its compliance.

Amendment 96 #

Morten LØKKEGAARD, Andrus ANSIP, Dita CHARANZOVÁ, Svenja HAHN

Proposal for a regulation
Recital 34

(34) To ensure that the national CSIRTs and the single point of contacts designated in accordance with Article [Article X] of Directive [Directive XX/XXXX (NIS2)] are provided with the information necessary to fulfil their tasks and raise the overall level of cybersecurity of essential and important entities, and to ensure the effective functioning of market surveillance authorities, manufacturers of products with digital elements should notify to ENISA vulnerabilities that are being actively exploited. As most products with digital elements are marketed across the entire internal market, any exploited vulnerability in a product with digital elements should be considered a threat to the functioning of the internal market. Manufacturers should also consider disclosing fixed vulnerabilities to the European vulnerability database established under Directive [Directive XX/XXXX (NIS2)] and managed by ENISA or under any other publicly accessible vulnerability database.deleted

Amendment 97 #

Proposal for a regulation
Recital 34 a (new)

(34 a) ENISA should be responsible for publishing and maintaining a database of known exploited vulnerabilities. Manufacturers should monitor the database and notify vulnerabilities found in their products.

Amendment 98 #

Proposal for a regulation
Recital 35

(35) Manufacturers should also report to ENISA any incident having an impact on the security of the product with digital elements. Notwithstanding the incident reporting obligations in Directive [Directive XXX/XXXX (NIS2)] for essential and important entities, it is crucial for ENISA, the single points of contact designated by the Member States in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] and the market surveillance authorities to receive information from the manufacturers of products with digital elements allowing them to assess the security of these products. In order to ensure that users can react quickly to incidents having an impact on the security of their products with digital elements, manufacturers should also inform their users about any such incident and, where applicable, about any corrective measures that the users can deploy to mitigate the impact of the incident, for example by publishing relevant information on their websites or, where the manufacturer is able to contact the users and where justified by the risks, by reaching out to the users directly.deleted

Amendment 99 #

Proposal for a regulation
Recital 35

(35) Manufacturers should also report to ENISA any incident having an impact on the security of the product with digital elements. Notwithstanding the incident reporting obligations in Directive [Directive XXX/XXXX (NIS2)] for essential and important entities, it is crucial for ENISA, the single points of contact designated by the Member States in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] and the market surveillance authorities to receive information from the manufacturers of products with digital elements allowing them to assess the security of these products. In order to ensure that users can react quickly to incidents having an impact on the security of their products with digital elements, manufacturers should also inform their users about any such incident and, where applicable, about any corrective measures that the users can deploy to mitigate the impact of the incident, for example by publishing relevant information on their websites or, where the manufacturer is able to contact the users and where justified by the risks, by reaching out to the users directly. Manufacturers that identify vulnerability in a component integrated in a product with digital elements, including in a free and open source component should report the vulnerability to the person or entity maintaining the component together with the corrective measure taken, and provide the corresponding code under a free and open source licence.

source: 746.662

2023/05/04 ITRE 423 amendments...

Amendment 124 #

Proposal for a regulation
Title 1

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on ~~horizo~~essential cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020 (Cyber Resilience Act) (Text with EEA relevance)

Amendment 125 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO, Lina GÁLVEZ

Proposal for a regulation
Recital 1

(1) ~~It is necessary to~~Cybersecurity is a key challenge for the European Union as the diffusion of products with digital elements is constantly rising. In this regard, cyberattacks are a matter of public interest as they can have a critical impact not only for the economy but also for consumers safety and health. It is therefore necessary to address cyber resilience at Union level and improve the functioning of the internal market by laying down a uniform legal framework for essential cybersecurity requirements for placing products with digital elements on the Union market. Two major problems adding costs for users and society should be addressed: a low level of cybersecurity of products with digital elements, reflected by widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them, and an insufficient understanding and access to information by users, preventing them from choosing products with adequate cybersecurity properties or using them in a secure manner.

Amendment 126 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Recital 4

(4) While the existing Union legislation applies to certain products with digital elements, there is no horizontal Union regulatory framework establishing comprehensive cybersecurity requirements for all products with digital elements. The various acts and initiatives taken thus far at Union and national levels only partially address the identified cybersecurity-related problems and risks, creating a legislative patchwork within the internal market, increasing legal uncertainty for both manufacturers and users of those products and adding an unnecessary burden on companies to comply with a number of requirements for similar types of products. The cybersecurity of these products has a particularly strong cross-border dimension, as products manufactured in one country are often used by organisations and consumers across the entire internal market. This makes it necessary to regulate the field at Union level. The Union regulatory landscape should be harmonised by introducing cybersecurity requirements for products with digital elements. In addition, certainty for operators and users should be ensured across the Union, as well as a better harmonisation of the single market, proportionality for micro, small and medium sized enterprises, thus creating more viable conditions for operators aiming at entering the Union market.

Amendment 127 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Recital 7

(7) Under certain conditions, all products with digital elements integrated in or connected to a larger electronic information system can serve as an attack vector for malicious actors. As a result, even hardware and software considered as less critical can facilitate the initial compromise of a device or network, enabling malicious actors to gain privileged access to a system or move laterally across systems. Manufacturers should therefore ensure that all ~~connectable~~ products with digital elements connected to external network or device are designed and developed in accordance with essential requirements laid down in this Regulation. This includes both products that can be connected to external networks or device physically via hardware interfaces and products that are connected logically, such as via network sockets, pipes, files, application programming interfaces or any other types of software interface. As cybersecurity threats can propagate through various products with digital elements before reaching a certain target, for example by chaining together multiple vulnerability exploits, manufacturers should also ensure the cybersecurity of those products that are only indirectly connected to other devices or networks.

Amendment 128 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Recital 7 a (new)

(7a) This regulation should not apply to the internal networks of a product with digital elements if these networks have dedicated endpoints and are secured from external data connection.

Amendment 129 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Recital 7 b (new)

(7b) This regulation should not apply to spare parts intended solely to replace defective parts of products with digital elements, in order to restore their functionality.

Amendment 130 #

Proposal for a regulation
Recital 8 a (new)

(8a) Directive (EU) 2022/2555 puts in place cybersecurity and incident reporting requirements for essential and important entities, such as critical infrastructure, with a view to increasing the resilience of the services they provide. It applies to cloud computing services and cloud service models, such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS) and Network as a Service (NaaS). All entities providing cloud computing services in the Union that meet or exceed the threshold for medium-sized enterprises and the smaller providers of cloud computing services identified in accordance with Article 2(2) fall in the scope of that Directive.

Amendment 131 #

Proposal for a regulation
Recital 9

(9) This Regulation ensures a high level of cybersecurity of products with digital elements~~. It does not regulate services, such as Software-as-a-Service (SaaS), except for~~, processes and ancillary services. The definition and regulatory scope for products with digital elements should also include remote data processing solutions ~~relating to a~~which are necessary for products with digital elements ~~understood as any data processing at a distance for which~~to perform its functions. Remote data processing solutions should be understood as any data processing at a distance, irrespective of whether data is processed or stored locally on the device of the user or remotely. Moreover, manufacturers shall remain responsible for the software which is designed and developed, as well as customised or substantially modified by the manufacturer of the product concerned or under the control or responsibility of that manufacturer, and the absence of which would prevent such a product with digital elements from performing one of its functions. Software-as-a-Service (SaaS) shall constitute remote data processing solutions within the meaning of this Regulation to the extent that is inextricably linked to the performing one the product functions. For instance, websites or cloud service models supporting the functionality of products with digital elements fall in the scope of this Regulation. [Directive XXX/XXXX (NIS2)] puts in place cybersecurity and incident reporting requirements for essential and important entities, such as critical infrastructure, with a view to increasing the resilience of the services they provide. [Directive XXX/XXXX (NIS2)] applies to cloud computing services and cloud service models, such as SaaS. All entities providing cloud computing services in the Union that meet or exceed the threshold for medium-sized enterprises fall in the scope of that Directive. Where the manufacturer employs such cloud solutions which are not covered by NIS 2 or uses a custom implementation of a cloud service model, the requirements in this Regulation should be applicable.

Amendment 132 #

Proposal for a regulation
Recital 9

(9) This Regulation does not regulate the cloud computing services, it ensures a high level of cybersecurity of products with digital elements. It does not regulate services, such as Software-as-a-Service (SaaS), except for remote data processing solutions relating to a product with digital elements understood as any data processing at a distance for which the software is designed and developed by the manufacturer of the product concerned or undThe cloud enabled remote data processing solutions relating to a product with digital elements should be however considered as integral part of the product, only where the responsibility of that manufacturer, and the absence of which would prevent such a product with digital elements from performing one of its functions. [Directive XXX/XXXX (NIS2)] puts in place cybersecurity and incident reporting requirements for essential and important entities, such as critical infrastructure, with a view to increasing the resilience of the services they provide. [Directive XXX/XXXX (NIS2)] applies to cloud computing services and cloud service models, such as SaaS. All entities providing cloud computing services in the Union that meet or exceed the threshold for medium-sized enterprises fall in the scope of that Directivesoftware for remote data processing is designed and developed by or for the manufacturer of the product concerned and is critical for the fundamental functions of the product with digital elements.

Amendment 133 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Recital 9

(9) This Regulation ensures a high level of cybersecurity of products with digital elements. It does not regulate services, such as Software-as-a-Service (SaaS), except for remote data processing solutions relating to a product with digital elements understood as any data processing at a distance for which the software is designed and developed by or on behalf of the manufacturer of the product concerned ~~or under the responsibility of that manufacturer~~, and the absence of which would prevent such a product with digital elements from performing one of its essential functions. [Directive ~~XXX/XXXX~~(EU) 2022/2555 (NIS2)] puts in place cybersecurity and incident reporting requirements for essential and important entities, such as critical infrastructure, with a view to increasing the resilience of the services they provide. [Directive ~~XXX/XXXX~~(EU) 2022/2555 (NIS2)] applies to cloud computing services and cloud service models, such as SaaS. All entities providing cloud computing services in the Union that meet or exceed the threshold for medium-sized enterprises fall in the scope of that Directive.

Amendment 134 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Recital 9 a (new)

(9a) Software and data that are openly shared and where users can freely access, use, modify and redistribute them or modified versions thereof, can contribute to research and innovation in the market. Research by the European Commission also shows that free and open-source software can contribute between €65 billion to €95 billion to the European Union’s GDP and that it can provide significant growth opportunities for the European economy. Users are allowed to run, copy, distribute, study, change and improve software and data, including models by way of free and open-source licences. To foster the development and deployment of free and open source software, especially by SMEs, start-ups, non-profits, academic research but also by individuals, this Regulation should not apply to such free and open-source software components, except in very specific cases. We must take into account the fact that different development models of software distributed and developed under public licences exist, having a wide a range of different roles in such development models. For example commercial open-source exists and is generally developed by a single organisation or an asymmetric community, where a single organisation is generating significant revenues from related use in business relationships. In contrast, vendor-neutral free and open source is developed by a symmetric community, sometimes under the governance of a non-profit organisation, ensuring transparency and neutrality in the development model and with no direct revenues from related use in business relationships. This is why this Regulation should differentiate and the independent developers of free and open-source software components should not be mandated under this Regulation to comply with requirements targeting the product value chain and, in particular, not towards the manufacturer that has used that free and open-source software component in a commercial product. Developers of free and open-source software components, as well as all manufacturers that are not subject to stricter compliance rules, should however be encouraged to implement the provisions of Annex I, as a way to increase security, allowing the promotion of trustworthy products with digital elements in the EU.

Amendment 135 #

Proposal for a regulation
Recital 10

(10) ~~In order not to hampe~~As a crucial tool for innovation orand research, free and open-source software ~~developed or~~ supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized ~~not only~~ by: charging a price for a product~~, but also by~~; charging a price for technical support services, bywhen this does not serve only the recuperation of actual costs; providing a software platform through which the manufacturer monetises other services~~, or by~~; the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. The circumstances under which the product has been developed, or how the development has been financed should not be taken into account when determining the commercial or non- commercial nature of that activity. When free and open-source software, supplied outside of the course of a commercial activity, is integrated into a final product with digital elements made available on the market, the economic operator that has placed the relevant product on the market shall be responsible for the compliance both of the product and of the integrated open-source software, according to this Regulation.

Amendment 136 #

Zdzisław KRASNODĘBSKI, Adam BIELAN, Kosma ZŁOTOWSKI

Proposal for a regulation
Recital 10

(10) In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. Nonetheless, in order to ensure that individual or micro developers of software as defined in Commission Recommendation 2003/361/EC do not face major financial obstacles and are not discouraged from testing the proof of concept as well as the business case on the market, these entities shall be required to make best efforts in order to comply with the requirements in this proposal during the 12 months from placing a software on the market. This special regime will prevent the chilling effect of high compliance and entry costs could have on entrepreneurs or skilled individuals who consider developing software in the European Union.

Amendment 137 #

Proposal for a regulation
Recital 10

(10) In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source codNeither the collaborative development of free and open-source software components nor making them available on open repositories should constitute a placing on the market or putting into service. As such, most package man~~d modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might~~agers, code hosting, and collaboration platforms do not make software products available on the market as distributors within this Act. A commercial activity, within the understanding of making available on the market, might however be characterizsed ~~not only~~ by charging a price for a ~~product, but also by~~free and open- source software component, but also by monetisation like charging a price for technical support services, paid software updates, by providing a software platform through which the ~~manufactur~~provider monetises other services~~, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software~~ (such as an App Store), or by the use of data. Unrelated consulting services, membership fees and not for profit sponsorships do not constitute monetisation within the scope of this regulation.When open-source software is integrated into a final product with digital elements that is placed on the market, the economic operator that has placed the final product with digital elements on the market shall be responsible for the compliance of the product including of the free and open-source components.

Amendment 138 #

Proposal for a regulation
Recital 10

Amendment 139 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Recital 10

(10) In order to enhance the collaborative development of free and open source software and not to hamper innovation or research, only free and open- source software ~~developed or supplied outside the course of~~used as a monetised product in a commercial activity should ~~not~~ be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. Under this Regulation, as manufacturer is considered the party commercially supplying the product to the market.

Amendment 140 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Recital 10

(10) In order not to hamper innovation or research, only free and open-source software developed or supplied ~~outside~~in the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services when this pursues a profit or the intention to monetise, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software.

Amendment 141 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Recital 10

Amendment 142 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Recital 10 a (new)

(10a) The lack of professional skills in the field of cybersecurity is a key issue to be tackled for the succesful application of this Regulation. Therefore, in line with the European Commission Communication "Closing the cybersecurity talent gap to boost the EU's competitiveness, growth and resilience ('The Cybersecurity Skills Academy')", specific measures both at EU and Member States level should be put in place to assess the state and the evolution of cybersecurity labour market and create a single point of entry and synergies for cybersecurity education and training offers with the aim of establishing a common EU approach to cybersecurity training.

Amendment 143 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Recital 13 a (new)

(13a) Agricultural and forestry vehicles in scope of Regulations (EU) 167/2013 of the European Parliament and of the Council fall also in the scope of this Regulation. In order to avoid regulatory overlaps, additional cybersecurity requirements in future amendments of Regulation (EU) 167/2013 should not be foreseen.

Amendment 144 #

Proposal for a regulation
Recital 14 a (new)

(14a) This Regulation should not apply to spare parts that are exclusively manufactured in order to repair and update products with digital elements that have been placed on the market before the application date of this Regulation.

Amendment 145 #

Proposal for a regulation
Recital 19

(19) Certain tasks provided for in this Regulation should be carried out by ENISA, in accordance with Article 3(2) of Regulation (EU) 2019/881. In particular, ENISA should receive notifications from manufacturers of actively exploited vulnerabilities contained in products with digital elements, as well asSIRTs should receive notifications from manufacturers of incidents having an impact on the security of those products. ~~ENISA~~CSIRTs should also forward these notifications ~~to the relevant Computer Security Incident Response Teams (CSIRTs) or, respectively,~~ to the relevant single points of contact of the Member States designated in accordance with Article [Article X] of Directive ~~[Directive XXX / XXXX (NIS2)]~~(EU) 2022/2555, and inform the relevant market surveillance authorities about the notified vulnerability. On the basis of the information it gathers, ENISA should prepare a biennial technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group referred to in Directive ~~[Directive XXX / XXXX (NIS2)]~~(EU) 2022/2555. Furthermore, considering its expertise and mandate, ENISA should be able to support the process for implementation of this Regulation. In particular, it should be able to propose joint activities to be conducted by market surveillance authorities, upon their request, based on indications or information regarding potential non- compliance with this Regulation of products with digital elements across several Member States or identify categories of products for which simultaneous coordinated control actions should be organised. In exceptional circumstances, at the request of the Commission, ENISA should be able to conduct evaluations in respect of specific products with digital elements that present a significant cybersecurity risk, where an immediate intervention is required to preserve the good functioning of the internal market.

Amendment 146 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Recital 19

(19) Certain tasks provided for in this Regulation should be carried out by ENISA, in accordance with Article 3(2) of Regulation (EU) 2019/881. In particular, ENISA should receive notifications from manufacturers of actively exploited vulnerabilities contained in products with digital elements, as well as incidents having an impact on the security of those products. ENISA should also forward these notifications to the relevant Computer Security Incident Response Teams (CSIRTs) or, respectively, to the relevant single points of contact of the Member States designated in accordance with Article [Article X] of Directive [Directive XXX / XXXX (NIS2)], and inform the relevant market surveillance authorities about the notified vulnerability. ENISA should ensure the confidentiality of these notifications with particular regard to vulnerabilities for which a security update is not yet available. On the basis of the information it gathers, ENISA should prepare a biennial technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group referred to in Directive [Directive XXX / XXXX (NIS2)]. Furthermore, considering its expertise and mandate, ENISA should be able to support the process for implementation of this Regulation. In particular, it should be able to propose joint activities to be conducted by market surveillance authorities based on indications or information regarding potential non-compliance with this Regulation of products with digital elements across several Member States or identify categories of products for which simultaneous coordinated control actions should be organised. In exceptional circumstances, at the request of the Commission, ENISA should be able to conduct evaluations in respect of specific products with digital elements that present a significant cybersecurity risk, where an immediate intervention is required to preserve the good functioning of the internal market.

Amendment 147 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Recital 19 a (new)

(19a) ENISA should publish and maintain a known exploited vulnerability catalogue that should be included in the European vulnerability database established under Directive 2022/2555 (NIS2). The catalogue should assist manufacturers in detecting known exploitable vulnerabilities and notify vulnerabilities found in their products, in order to ensure that secure products are placed on the market.

Amendment 148 #

Proposal for a regulation
Recital 22

(22) In order to ensure that products with digital elements, when placed on the market, do not pose cybersecurity risks to persons and organisations, essential requirements should be set out for such products. When the products are subsequently modified, by physical or digital means, in a way that is not foreseen by the manufacturer and that may imply that they no longer meet the relevant essential requirements, the modification should be considered as substantial. For example, software updates or repairs could be assimilated to maintenance operations provided that they do not modify a product already placed on the market in such a way that compliance with the applicable requirements may be affected, or that the intended use for which the product has been assessed may be changed. As is the case for physical repairs or modifications, a product with digital elements should be considered as substantially modified by a software change where the software update modifies the original intended functions, type or performance of the product and these changes were not foreseen in the initial risk assesseyond necessary maintenance or security update, by physical or digital means, by the manufacturer and results in modification of the product’s fundamental functions or its intended use and thus significantly affects the relevant essential requirements, or the ~~nature of the hazard has changed or the level of risk has increased because of the software update~~modification should be considered as substantial.

Amendment 149 #

Nicola DANTI

Proposal for a regulation
Recital 22

(22) In order to ensure that products with digital elements, when placed on the market, do not pose cybersecurity risks to persons and organisations, essential requirements should be set out for such products. When the products are subsequently modified, by physical or digital means, in a way that is not foreseen by the manufacturer and that may imply that they no longer meet the relevant essential requirements, the modification should be considered as substantial. For example, software updates or repairs could be assimilated to maintenance operations provided that they do not modify a product already placed on the market in such a way that compliance with the applicable requirements may be affected, or that the intended use for which the product has been assessed may be changed. Modifications to open source software aimed at fixing vulnerabilities or improving performance should not not be considered as substantial. As is the case for physical repairs or modifications, a product with digital elements should be considered as substantially modified by a software change where the software update modifies the original intended functions, type or performance of the product and these changes were not foreseen in the initial risk assessment, or the nature of the hazard has changed or the level of risk has increased because of the software update.

Amendment 150 #

Proposal for a regulation
Recital 22

(22) In order to ensure that products with digital elements, when placed on the market, do not pose cybersecurity risks to persons and organisations, essential requirements should be set out for such products. When the products are subsequently modified, by physical or digital means, in a way that is not foreseen by the manufacturer and that may imply that they no longer meet the relevant essential requirements, the modification should be considered as substantial. For example, software updates or repairs such as minor adjustment of the source code that can improve the security and functioning, could be assimilated to maintenance operations provided that they do not modify a product already placed on the market in such a way that compliance with the applicable requirements may be affected, or that the intended use for which the product has been assessed may be changed. As is the case for physical repairs or modifications, a product with digital elements should be considered as substantially modified by a software change where the software update modifies the original intended functions, type or performance of the product and these changes were not foreseen in the initial risk assessment, or the nature of the hazard has changed or the level of risk has increased because of the software update.

Amendment 151 #

Proposal for a regulation
Recital 23

(23) In line with the commonly established notion of substantial modification for products regulated by Union harmonisation legislation, whenever a substantial modification occurs ~~that may affect the compliance of a product with this Regulation or when the intended purpose of that product changes~~, it is appropriate that the compliance of the product with digital elements is verified and that, where applicable, it undergoes an updated conformity assessment focusing on the modified elements or new conformity assessment. Where applicable, if the manufacturer undertakes a conformity assessment involving a third party, changes that might lead to substantial modifications should be notified to the third party.

Amendment 152 #

Proposal for a regulation
Recital 24 a (new)

(24a) Manufacturers of products with digital elements should ensure that software updates are provided in a clear and transparent way and clearly differentiate between security and functionality updates. Whilst security updates are designed to decrease the level of risk of a product with digital elements, the uptake of functionality updates provided by the manufacturer should always remain a user choice. Manufacturers should therefore provide these updates separately, unless technically unfeasible. Manufacturers should provide consumers with adequate information on the reasons behind each update and its foreseen impact on the product, as well as a clear and easy-to-use opt-out mechanism.

Amendment 153 #

Proposal for a regulation
Recital 24 a (new)

(24a) Manufacturers of products with digital elements shall provide software updates in a clear and transparent way in order to enhance the security protection and the functionality of the products, during the entire duration of the product's expected lifetime. Functionality and security updates shall be differentiated and users shall be clearly informed by the manufacturers regarding the nature and features of the updates. Software updates shall not intentionally affect the functionalities and the intended use of the products nor lessen its expected period of lifetime.

Amendment 154 #

Proposal for a regulation
Recital 25

(25) Products with digital elements should be considered critical if the negative impact of the exploitation of potential cybersecurity vulnerabilities in the product can be severe due to, amongst others, the cybersecurity-related functionality, or the intended use or the size of market penetration of a particular product. In particular, vulnerabilities in products with digital elements that have a cybersecurity- related functionality, such as secure elements, can lead to a propagation of security issues throughout the supply chain or society. The severity of the impact of a cybersecurity incident may also increase when taking into account the intended use of the product, such as in an industrial setting or in the context of an essential entity of the type referred to in Annex [Annex I] to Directive [Directive XXX/ XXXX (NIS2)], or for the performance of critical or sensitive functions, ~~such as processing of personal data~~impacting health, safety or fundamental rights.

Amendment 155 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Recital 26

(26) Critical products with digital elements should be subject to stricter conformity assessment procedures, while keeping a proportionate approach. For this purpose, critical products with digital elements should be divided into two classes, reflecting the level of cybersecurity risk linked to these categories of products. A potential cyber incident involving products in class II might lead to greater negative impacts than an incident involving products in class I, for instance due to the nature of their cybersecurity-related function or intended use in sensitive environments, and therefore should undergo a stricter conformity assessment procedure. Periodical checks should be carried out to ensure that the list of critical products with digital elements is updated.

Amendment 156 #

Proposal for a regulation
Recital 26

(26) Critical products with digital elements should be subject to stricter third- party conformity assessment procedures, ~~while keeping a proportionate approach~~certified by the relevant EU and Member States' authorities. For this purpose, critical products with digital elements should be divided into two classes, reflecting the level of cybersecurity risk linked to these categories of products. A potential cyber incident involving products in class II might lead to greater negative impacts than an incident involving products in class I, for instance due to the nature of their cybersecurity-related function or intended use in sensitive environments, and therefore should undergo a stricter conformity assessment procedure.

Amendment 157 #

Proposal for a regulation
Recital 26

(26) Critical products with digital elements should be subject to stricter conformity assessment procedures, while keeping a proportionate approach. For this purpose, critical products with digital elements should be divided into two classes, reflecting the level of cybersecurity risk linked to these categories of products. A potential cyber incident involving products in class II might lead to greater negative impacts than an incident involving products in class I, for instance due to the nature of their cybersecurity-related function or intended use in ~~sensitive~~highly critical environments, and therefore should undergo a stricter conformity assessment procedure.

Amendment 158 #

Proposal for a regulation
Recital 28

Amendment 159 #

Proposal for a regulation
Recital 30

Amendment 160 #

Proposal for a regulation
Recital 31

Amendment 161 #

Proposal for a regulation
Recital 32

(32) In order to ensure that products with digital elements are secure both at the time of their placing on the market as well as throughout their life-cycle, it is necessary to lay down essential requirements for vulnerability handling and essential cybersecurity requirements relating to the properties of products with digital elements. While manufacturers should comply with all essential requirements related to vulnerability handling ~~and~~, they should determine which other essential requirements related to the product properties are relevant for the concerned type of product, they should for instance ensure that all their products are delivered without any known ~~exploitable~~patched vulnerabilities~~, they should determine which other essential requirements related to the product properties are relevant for the concerned type of product~~ or that the appropriate impact mitigation such as by security updates before the product is put into service for the first time. For this purpose, manufacturers should undertake an assessment of the cybersecurity risks associated with a product with digital elements to identify relevant risks and relevant essential requirements and in order to appropriately apply suitable harmonised ~~standards or common specification~~or international standards.

Amendment 162 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Angelika NIEBLER

Proposal for a regulation
Recital 32

(32) In order to ensure that products with digital elements are secure both at the time of their placing on the market as well as throughout their life-cycle, it is necessary to lay down essential requirements for vulnerability handling and essential cybersecurity requirements relating to the properties of products with digital elements. While manufacturers should comply with all essential requirements related to vulnerability handling and ensure that all their products are delivered without any ~~known~~ exploitable vulnerabilities known to them, they should determine which other essential requirements related to the product properties are relevant for the concerned type of product. For this purpose, manufacturers should undertake an assessment of the cybersecurity risks associated with a product with digital elements to identify relevant risks and relevant essential requirements and in order to appropriately apply suitable harmonised standards or common specifications.

Amendment 163 #

Proposal for a regulation
Recital 32 a (new)

(32a) In order to ensure the products are designed, developed and produced in line with essential requirements foreseen in Section 1 of Annex I, manufacturers should exercise due diligence when integrating components sourced from third parties in products with digital elements. Given that such components are tailored to and integrated taken into account the specificities of the product, in particular in the case of free and open source software that have not been placed on the market in exchange of financial or other type of monetisation, the manufacturer of the product shall be responsible for ensuring its compliance.

Amendment 164 #

Proposal for a regulation
Recital 34

(34) To ensure that the national CSIRTs and the single point of contacts designated in accordance with Article [Article X] of Directive ~~[Directive XX/XXXX (NIS2)]~~(EU) 2022/2555 are provided with the information necessary to fulfil their tasks and raise the overall level of cybersecurity of essential and important entities, and to ensure the effective functioning of market surveillance authorities, manufacturers of products with digital elements should notify to ~~ENISA vulnerabilities that are being actively exploited~~CSIRTs all fixed vulnerabilities, and on a voluntary basis also unpatched vulnerabilities. As most products with digital elements are marketed across the entire internal market, any exploited vulnerability in a product with digital elements should be considered a threat to the functioning of the internal market. Manufacturers should ~~also consider~~therefore disclos~~ing~~e fixed vulnerabilities to the European vulnerability database established under Directive ~~[Directive XX/XXXX (NIS2)] and managed by ENISA or under any other publicly accessible vulnerability database~~(EU) 2022/2555 and managed by ENISA. Manufacturers should also benefit from coordinated vulnerability disclosure mechanism established under Directive (EU) 2022/2555.

Amendment 165 #

Proposal for a regulation
Recital 34 a (new)

(34a) Dependencies on high-risk suppliers of critical products with digital elements intended for the use by essential entities of the type referred to in [Annex I to the Directive XXX/XXXX (NIS2)] pose a strategic risk that needs to be mitigated at Union level. To mitigate this strategic risk there is a need to move beyond non- binding initiatives, such as the 5G toolbox, and move towards a binding toolbox for reducing critical ICT supply chain risks adopted as a delegated act. It should leverage the lessons learned from those past and national experiences, be based upon a risk assessment and offer strategic risk mitigation measures. Critical products with digital elements used in critical sectors should therefore be subjected to a strategic supply chain risk assessment that includes non-technical factors to assess the risk of the manufacturer being subject to undue interference from a third country. Those factors may include the jurisdiction of the supplier/manufacturer and the characteristics of the supplier’s corporate ownership and the links of control to a third-country government where it is established. A high risk is attributed to a third country’s legislation that obliges arbitrary access to any kind of company data, that would e.g. allow it to conduct economic espionage, without legislative or democratic checks and balances, meaningful oversight mechanisms or the right to appeal to an independent judiciary. A high risk is also attributed where a manufacturer is operating under foreign ownership or control that has the power, direct or indirect, whether or not exercised, to direct or decide matters affecting the management or operations of the manufacturer, or in case of opaque ownership structures, which are are state- owned or controlled. Not all instances of control will create security risks, but what should be considered is the extent to which the use of the critical product by the entities: (a) includes access to sensitive or classified information or assets, (b) relates to the storage or transport of sensitive materials or substances, (c) relates to the provision of security services for physical sites or facilities, (d) is for, or relates to, the storage or protection of sensitive or classified information. Non-technical risk factors should not impede procurement from entities established in likeminded strategic partner countries.

Amendment 166 #

Proposal for a regulation
Recital 35

(35) Manufacturers should also report to ENISA any incident having an impact on the security of the product with digital elements. Notwithstanding the incident reporting obligations in Directive [Directive XXX/XXXX (NIS2)] for essential and important entities, it is crucial for ENISA, the single points of contact designated by the Member States in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] and the market surveillance authorities to receive information from the manufacturers of products with digital elements allowing them to assess the security of these products. In order to ensure that users can react quickly to incidents having an impact on the security of their products with digital elements, manufacturers should also inform their users about any such incident and, where applicable, about any corrective measures that the users can deploy to mitigate the impact of the incident, for example by publishing relevant information on their websites or, where the manufacturer is able to contact the users and where justified by the risks, by reaching out to the users directly. Manufacturers that identify vulnerability in a component integrated in a product with digital elements, including in a free and open source component should report the vulnerability to the person or entity maintaining the component together with the corrective measure taken, and provide the corresponding code under a free and open source licence.

Amendment 167 #

Proposal for a regulation
Recital 35

(35) Manufacturers should also report to ~~ENISA any~~CSIRTs any significant incident having an impact on the security of the product with digital elements, and on a voluntary basis any other incident, near miss or cyber threat. Notwithstanding the incident reporting obligations in Directive ~~[Directive XXX/XXXX (NIS2)]~~(EU) 2022/2555 for essential and important entities, it is crucial for CSIRT, ENISA, the single points of contact designated ~~by the Member States~~ in accordance with Article ~~[Article X]~~8 of Directive ~~[Directive XXX/XXXX (NIS2)]~~(EU) 2022/2555 and the market surveillance authorities to receive information from the manufacturers of products with digital elements allowing them to assess the security of these products. In order to ensure that users can react quickly to incidents having an impact on the security of their products with digital elements, manufacturers should also inform their users about any such incident and, where applicable, about any corrective measures that the users can deploy to mitigate the impact of the incident, for example by publishing relevant information on their websites or, where the manufacturer is able to contact the users and where justified by the risks, by reaching out to the users directly.

Amendment 168 #

Proposal for a regulation
Recital 35 a (new)

(35a) The manufacturers of products with digital elements are often in a situation where a particular incident, because of its features, needs to be reported to various authorities as a result of notification obligations included in various legal instruments. Such cases create additional burdens and may also lead to uncertainties with regard to the format and procedures of such notifications. In view of this and, for the purposes of simplifying the reporting of security incidents, Member States should establish a single entry point for all notifications required under this Regulation, Directive (EU) 2022/2555, and possibly also under other Union law such as Regulation (EU) 2016/679 and Directive 2002/58/EC. The Commission should develop and adopt common notification templates by means of implementing acts that would simplify and streamline the reporting information requested by Union law and decrease the burdens for companies.

Amendment 169 #

Angelika NIEBLER

Proposal for a regulation
Recital 35 a (new)

(35a) To minimise bureaucratic burden, especially on SMEs, there should be only two reporting stages after discovering an actively exploited vulnerability and the reportings should include only necessary information to make the competent authority aware of the incident and the measures taken and allow for the entity to seek assistance. The early warning after 24 hours should be seen as first notification with only the most essential information to raise ENISA’s awareness of the incident. After 72 hours, a manufacturer should state more precisely which measures were taken after the incident.

Amendment 170 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Angelika NIEBLER

Proposal for a regulation
Recital 35 a (new)

(35a) Reporting should be as convenient and efficient as possible. For this purpose, ENISA should provide for an online system into which all requested information can be inserted.

Amendment 171 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Recital 36

(36) Manufacturers of products with digital elements should put in place ~~coordinated~~ vulnerability disclosure policies that are coordinated in terms of frequency and timing to facilitate the reporting of vulnerabilities by individuals or entities. A coordinated vulnerability disclosure policy should specify a structured process through which vulnerabilities are reported to a manufacturer in a manner allowing the manufacturer to diagnose and remedy such vulnerabilities before detailed vulnerability information is disclosed to third parties or to the public. Given the fact that information about exploitable vulnerabilities in widely used products with digital elements can be sold at high prices on the black market, manufacturers of such products should be able to use programmes, as part of their coordinated vulnerability disclosure policies, to incentivise the reporting of vulnerabilities by ensuring that individuals or entities receive recognition and compensation for their efforts (so-called ‘bug bounty programmes’).

Amendment 172 #

Proposal for a regulation
Recital 36

(36) Manufacturers of products with digital elements should put in place additional own coordinated vulnerability disclosure policies to facilitate the reporting of vulnerabilities by individuals or entities. A coordinated vulnerability disclosure policy should specify a structured process through which vulnerabilities are reported to a manufacturer in a manner allowing the manufacturer to diagnose and remedy such vulnerabilities before detailed vulnerability information is disclosed to third parties or to the public. Given the fact that information about exploitable vulnerabilities in widely used products with digital elements can be sold at high prices on the black market, manufacturers of such products should be able to use programmes, as part of their coordinated vulnerability disclosure policies, to incentivise the reporting of vulnerabilities by ensuring that individuals or entities receive recognition and compensation for their efforts (so-called ‘bug bounty programmes’).

Amendment 173 #

Proposal for a regulation
Recital 37

(37) In order to facilitate vulnerability analysis, manufacturers should identify and document components contained in the products with digital elements, including for relevant software products by drawing up a software bill of materials~~. A software bill of materials~~ (SBOMs). A SBOM can provide those who manufacture, purchase, and operate software with information that enhances their understanding of the supply chain, which has multiple benefits, most notably it helps manufacturers and users to track known newly emerged vulnerabilities and risks. It is of particular importance for manufacturers to ensure that their products do not contain vulnerable components developed by third parties.

Amendment 174 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Recital 38

(38) In order to facilitate assessment of conformity with the requirements laid down by this Regulation, there should be a presumption of conformity for products with digital elements which are in conformity with harmonised horizontal or domain specific standards, which translate the essential requirements of this Regulation into detailed technical specifications, and which are adopted in accordance with Regulation (EU) No 1025/2012 of the European Parliament and of the Council29. Regulation (EU) No 1025/2012 provides for a procedure for objections to harmonised standards where those standards do not entirely satisfy the requirements of this Regulation. _________________ 29 Regulation (EU) No 1025/2012 of the European Parliament and of the Council of 25 October 2012 on European standardisation, amending Council Directives 89/686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of the European Parliament and of the Council and repealing Council Decision 87/95/EEC and Decision No 1673/2006/EC of the European Parliament and of the Council (OJ L 316, 14.11.2012, p. 12).

Amendment 175 #

Proposal for a regulation
Recital 38 a (new)

(38a) According to the WTO Agreement on Technical Barriers to Trade, when technical regulations are necessary and relevant international standards exist, WTO Members should use those standards as the basis for their own technical regulations. It is important to avoid duplication of work among standardisation organisations, as international standards are intended to facilitate the harmonisation of national and regional technical regulations and standards, thereby reducing non-tariff technical barriers to trade. Given that cybersecurity is a global issue, the EU should strive for maximum alignment. To achieve this objective, the standardisation request for this Regulation, as set out in Article 10 of Regulation (EU) 1025/2012, should seek to reduce barriers to the acceptance of standards by publishing their references in the Official Journal of the EU, in accordance with Article 10(6) of Regulation (EU) 1025/2012.

Amendment 176 #

Proposal for a regulation
Recital 38 b (new)

(38b) Considering the broad scope of this Regulation, the timely development of harmonised standards poses a significant challenge. To enhance the security of products with digital components in the Union market, international standards should be published as a standard providing presumption of conformity.

Amendment 177 #

Proposal for a regulation
Recital 39

(39) Regulation (EU) 2019/881 establishes a voluntary European cybersecurity certification framework for ICT products, processes and services. European cybersecurity certification schemes ~~can cover products with digital elements covered by this Regulation~~thus provide a common framework of trust for users to use ICT products by assessing their level of cybersecurity. This Regulation should consequently create synergies with Regulation (EU) 2019/881. Regulation (EU) 2019/881 should address products with critical cybersecurity aspects and this Regulation should be dedicated to minimising the risk of incidents and cyberattacks. In order to facilitate the assessment of conformity with the requirements laid down in this Regulation, products with digital elements that are certified or for which a statement of conformity has been issued under a cybersecurity scheme pursuant to Regulation (EU) 2019/881 and which has been identified by the Commission in an implementing act, shall be presumed to be in compliance with the essential requirements of this Regulation in so far as the cybersecurity certificate or statement of conformity or parts thereof cover those requirements. The need for new European cybersecurity certification schemes for products with digital elements should be assessed in the light of this Regulation. Such future European cybersecurity certification schemes covering products with digital elements should take into account the essential requirements as set out in this Regulation and facilitate compliance with this Regulation. The Commission should be empowered to specify, by means of implementing acts, the use of European cybersecurity certification schemes ~~that can be used~~for critical products to demonstrate conformity with the essential requirements set out in this Regulation. Furthermore, in order to avoid undue administrative burden for manufacturers, wthere ~~applicable, the Commission should specify if a cybersecurity certificate issued under such European cybersecurity certification schemes eliminates the~~should be no obligation ~~for~~on manufacturers to carry out a third-party conformity assessment as provided by this Regulation for corresponding requirements where a cybersecurity certificate has been issued under such European cybersecurity certification schemes, at a substantial or high level.

Amendment 178 #

Proposal for a regulation
Recital 41

(41) Where no harmonised standards are adopted or where the harmonised standards do not sufficiently address the essential requirements of this Regulation, the Commission should be able to adopt common specifications by means of implementing acts. Reasons for developing such common specifications, instead of relying on harmonised standards, might include a refusal of the standardisation request by any of the European standardisation organisations, undue delays in the establishment of appropriate harmonised standards, or a lack of compliance of developed standards with the requirements of this Regulation or with a request of the Commission. In order to facilitate assessment of conformity with the essential requirements laid down by this Regulation, there should be a presumption of conformity for products with digital elements that are in conformity with the common specifications adopted by the Commission according to this Regulation for the purpose of expressing detailed technical specifications of those requirements.deleted

Amendment 179 #

Proposal for a regulation
Recital 41

(41) Where no harmonised standards are adopted or where the harmonised standards do not sufficiently address the essential requirements of this Regulation, the Commission should be able to adopt common specifications by means of implementing acts. Reasons for developing such common specifications, instead of relying on harmonised standards, might include a refusal of the standardisation request by any of the European standardisation organisations, undue delays in the establishment of appropriate harmonised standards, or a lack of compliance of developed standards with the requirements of this Regulation or with a request of the Commission. When developing such common specifications, the Commission should take into consideration the relevant international standards. In order to facilitate assessment of conformity with the essential requirements laid down by this Regulation, there should be a presumption of conformity for products with digital elements that are in conformity with the common specifications adopted by the Commission according to this Regulation for the purpose of expressing detailed technical specifications of those requirements.

Amendment 180 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Recital 41

(41) Where no harmonised standards are adopted, and after taking in due consideration widely accepted international standards, or where the harmonised standards do not sufficiently address the essential requirements of this Regulation, the Commission should be able to adopt common specifications by means of ~~implementing~~delegated acts. Reasons for developing such common specifications, instead of relying on harmonised standards, might include a refusal of the standardisation request by any of the European standardisation organisations, undue delays in the establishment of appropriate harmonised standards, or a lack of compliance of developed standards with the requirements of this Regulation or with a request of the Commission. In order to facilitate assessment of conformity with the essential requirements laid down by this Regulation, there should be a presumption of conformity for products with digital elements that are in conformity with the common specifications adopted by the Commission according to this Regulation for the purpose of expressing detailed technical specifications of those requirements.

Amendment 181 #

Proposal for a regulation
Recital 45

Amendment 182 #

Proposal for a regulation
Recital 45

(45) As a general rule the conformity assessment of products with digital elements should be carried out by the manufacturer under its own responsibility following the procedure based on Module A of Decision 768/2008/EC. The manufacturer should retain flexibility to choose a stricter conformity assessment procedure involving a third- party. If the product is classified as a critical product of class I, additional assurance is required to demonstrate conformity with the essential requirements set out in this Regulation. The manufacturer should apply harmonised standards, ~~common specifications~~international standards, or cybersecurity certification schemes under Regulation (EU) 2019/881 which have been identified by the Commission in an implementing act, if it wants to carry out the conformity assessment under its own responsibility (module A). If the manufacturer does not apply such harmonised standards, ~~common specifications~~international standards, or cybersecurity certification schemes, the manufacturer should undergo conformity assessment involving a third party. Taking into account the administrative burden on manufacturers and the fact that cybersecurity plays an important role in the design and development phase of tangible and intangible products with digital elements, conformity assessment procedures respectively based on modules B+C or module H of Decision 768/2008/EC have been chosen as most appropriate for assessing the compliance of critical products with digital elements in a proportionate and effective manner. The manufacturer that carries out the third- party conformity assessment can choose the procedure that suits best its design and production process. Given the even greater cybersecurity risk linked with the use of products classified as critical class II products, the conformity assessment should always involve a third party.

Amendment 183 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Recital 53

(53) In the interests of competitiveness, it is crucial that notified bodies apply the conformity assessment procedures without creating unnecessary burden for economic operators, in particular for micro, small, medium sized enterprises. In this regard, Member States, with the support of the Commission, should ensure that there is an adequate availability of cybersecurity skilled professionals in order to ensure that notified bodies can carry out their activities efficiently thus facilitating economic operators' compliance to this Regulation. For the same reason, and to ensure equal treatment of economic operators, consistency in the technical application of the conformity assessment procedures needs to be ensured. That should be best achieved through appropriate coordination and cooperation between notified bodies.

Amendment 184 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Recital 53

(53) In the interests of competitiveness, it is crucial that notified bodies apply the conformity assessment procedures without creating unnecessary burden ~~for~~on economic operators. In order to ensure that notified bodies are able to perform their tasks efficiently, and to minimise possible impediments, the Commission and Member States should ensure that there are skilled professionals in the Union. For the same reason, and to ensure equal treatment of economic operators, consistency in the technical application of the conformity assessment procedures needs to be ensured. That should be best achieved through appropriate coordination and cooperation between notified bodies.

Amendment 185 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Recital 53 a (new)

(53a) In order to increase efficiency and transparency, the Commission should within 24 months from the entry into force of this Regulation, ensure that there is a sufficient number of notified bodies in the Union to carry out a conformity assessment, in order to avoid bottlenecks and hindrances to market entry.

Amendment 186 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Recital 56

(56) A dedicated administrative cooperation group (ADCO) for cyber resilience of products with digital elements should be established for the uniform application of this Regulation, pursuant to Article 30(2) of Regulation (EU) 2019/1020. This ADCO should be composed of representatives of the designated market surveillance authorities and, if appropriate, representatives of the single liaison offices. The Commission should support and encourage cooperation between market surveillance authorities through the Union Product Compliance Network, established on the basis of Article 29 of Regulation (EU) 2019/1020 and comprising representatives from each Member State, including a representative of each single liaison office referred to in Article 10 of Regulation (EU) 2019/1020 and an optional national expert, the chairs of ADCOs, and representatives from the Commission. The Commission should participate in the meetings of the Network, its sub-groups and this respective ADCO. It should also assist this ADCO by means of an executive secretariat that provides technical and logistic support.

Amendment 187 #

Proposal for a regulation
Recital 57 a (new)

(57a) In this framework, in order to provide updated information on the cyber security of critical products with digital elements, as defined in Annex III, the Commission should consider the adoption of measures aimed at informing the market on products that, according to Article 10 (6) of this Regulation, will not receive any further cyber security management.

Amendment 188 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Recital 61

(61) Simultaneous coordinated control actions (‘sweeps’) are specific enforcement actions by market surveillance authorities that can further enhance product security. Sweeps should, in particular, be conducted where market trends, consumer complaints or other indications suggest that certain product categories are often found to present cybersecurity risks. ENISA should submit proposals for categories of products for which sweeps could be organised to the market surveillance authorities, based, among others, on the notifications of product vulnerabilities and incidents it receives. ENISA should also coordinate national market surveillance authorities for regular checks of products with digital elements placed on the market by manufacturers that might present a security risk for the EU, with particular regard to identifying exploitable vulnerabilities.

Amendment 189 #

Beatrice COVASSI

Proposal for a regulation
Recital 62

(62) In order to ensure that the regulatory framework can be adapted where necessary, the power to adopt acts in accordance with Article 290 of the Treaty should be delegated to the Commission in respect of updates to the list of critical products in Annex III and specifying the definitions of the these product categories. Power to adopt acts in accordance with that Article should be delegated to the Commission to identify products with digital elements covered by other Union rules which achieve the same level of protection as this Regulation, specifying whether a limitation or exclusion from the scope of this Regulation would be necessary as well as the scope of that limitation, if applicable. Power to adopt acts in accordance with that Article should also be delegated to the Commission in respect of the potential mandating of certification of certain highly critical products with digital elements based on criticality crieria set out in this Regulation, as well as for specifying the minimum content of the EU declaration of conformity and supplementing the elements to be included in the technical documentation. Powers to adopt acts should also be delegated to the Commission to specify the format and elements of the software bill of materials, specify further the type of information, format and procedure of the notifications on actively exploited vulnerabilities and incidents submitted to ENISA by manufacturers. The Commission is also empowered to adopt delegated acts to establish common specifications in respect of the essential requirements set out in Annex I. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making33. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. _________________ 33 OJ L 123, 12.5.2016, p. 1.

Amendment 190 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Recital 62

(62) In order to ensure that the regulatory framework can be adapted where necessary, the power to adopt acts in accordance with Article 290 of the Treaty should be delegated to the Commission in respect of updates to the list of critical products in Annex III and specifying the definitions of the these product categories. Such updates shall be carried out periodically by the Commission, ensuring timely changes to the list of critical products in Annex III. Power to adopt acts in accordance with that Article should be delegated to the Commission to identify products with digital elements covered by other Union rules which achieve the same level of protection as this Regulation, specifying whether a limitation or exclusion from the scope of this Regulation would be necessary as well as the scope of that limitation, if applicable. Power to adopt acts in accordance with that Article should also be delegated to the Commission in respect of the potential mandating of certification of certain highly critical products with digital elements based on criticality crieria set out in this Regulation, as well as for specifying the minimum content of the EU declaration of conformity and supplementing the elements to be included in the technical documentation. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making33. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. _________________ 33 OJ L 123, 12.5.2016, p. 1.

Amendment 191 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA

Proposal for a regulation
Recital 63

(63) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission to: specify the format and elements of the software bill of materials, specify further the type of information, format and procedure of the notifications on actively exploited vulnerabilities and incidents submitted to ENISA by the manufacturers, specify the European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 that can be used to demonstrate conformity with the essential requirements or parts therefore as set out in Annex I of this Regulation, ~~adopt common specifications in respect of the essential requirements set out in Annex I,~~ lay down technical specifications for pictograms or any other marks related to the security of the products with digital elements, and mechanisms to promote their use, decide on corrective or restrictive measures at Union level in exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council34. _________________ 34 Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p.13).

Amendment 192 #

Proposal for a regulation
Recital 63

(63) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission to, in open consultation with stakeholders and in consideration of international and industry standards: specify the format and elements of the software bill of materials, specify further the type of information, format and procedure of the notifications on actively exploited vulnerabilities and incidents submitted to ENISA by the manufacturers, specify the European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 that can be used to demonstrate conformity with the essential requirements or parts therefore as set out in Annex I of this Regulation, adopt common specifications in respect of the essential requirements set out in Annex I, lay down technical specifications for pictograms or any other marks related to the security of the products with digital elements, and mechanisms to promote their use, decide on corrective or restrictive measures at Union level in exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council34. _________________ 34 Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p.13).

Amendment 193 #

Proposal for a regulation
Recital 63

(63) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission to: specify the recommended format and elements of the software bill of materials, specify further the type of information, format and procedure of the notifications on ~~actively exploit~~patched vulnerabilities and incidents submitted to ~~ENISA~~CSIRTs by the manufacturers, specify the European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 that can be used to demonstrate conformity with the essential requirements or parts therefore as set out in Annex I of this Regulation, ~~adopt common specifications in respect of the essential requirements set out in Annex I,~~ lay down technical specifications for pictograms or any other marks related to the security of the products with digital elements, and mechanisms to promote their use, decide on corrective or restrictive measures at Union level in exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council34. _________________ 34 Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p.13).

Amendment 194 #

Proposal for a regulation
Recital 65

(65) In order to ensure effective enforcement of the obligations laid down in this Regulation, each market surveillance authority should have the power to impose or request the imposition of administrative fines. Maximum levels for administrative fines to be provided for in national laws for non-compliance with the obligations laid down in this Regulation should therefore be established. When deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation should be taken into account and as a minimum those explicitly established in this Regulation, including whether the manufacturer is SME, with particular attention payed to micro manufacturers and start-ups, or whether administrative fines have been already applied by other market surveillance authorities to the same operator for similar infringements. Such circumstances can be either aggravating, in situations where the infringement by the same operator persists on the territory of other Member States than the one where an administrative fine has already been applied, or mitigating, in ensuring that any other administrative fine considered by another market surveillance authority for the same economic operator or the same type of breach should already take account, along with other relevant specific circumstances, of a penalty and the quantum thereof imposed in other Member States. In all such cases, the cumulative administrative fine that could be applied by market surveillance authorities of several Member States to the same economic operator for the same type of infringement should ensure the respect of the principle of proportionality.

Amendment 195 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Recital 65

(65) In order to ensure effective enforcement of the obligations laid down in this Regulation, each market surveillance authority should have the power to impose or request the imposition of administrative fines. Maximum levels for administrative fines to be provided for in national laws for non-compliance with the obligations laid down in this Regulation should therefore be established. When deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation should be taken into account, notably the economic operator's size, whether it is a micro, small or medium sized enterprise, and as a minimum th~~ose~~e circumstances explicitly established in this Regulation, including whether administrative fines have been already applied by other market surveillance authorities to the same operator for similar infringements. Such circumstances can be either aggravating, in situations where the infringement by the same operator persists on the territory of other Member States than the one where an administrative fine has already been applied, or mitigating, in ensuring that any other administrative fine considered by another market surveillance authority for the same economic operator or the same type of breach should already take account, along with other relevant specific circumstances, of a penalty and the quantum thereof imposed in other Member States. In all such cases, the cumulative administrative fine that could be applied by market surveillance authorities of several Member States to the same economic operator for the same type of infringement should ensure the respect of the principle of proportionality.

Amendment 196 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Recital 66 a (new)

(66a) The revenues generated from the payments of penalties should be used to strengthen the level of cybersecurity within the Union, including by developing capacity and skills related to cybersecurity, improving economic operators' cyber resilience, in particular of micro, small and medium sized enterprises and more in general fostering public awareness of cyber security issues.

Amendment 197 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Recital 69

Amendment 198 #

Proposal for a regulation
Recital 69

(69) Economic operators should be provided with a sufficient time to adapt to the requirements of this Regulation. This Regulation should apply [2430 months] from its entry into force, with the exception of the reporting obligations concerning actively exploited vulnerabilities and incidents, which should apply [12 months] from the entry into force of this Regulation.

Amendment 199 #

Proposal for a regulation
Recital 69

(69) Economic operators should be provided with a sufficient time to adapt to the requirements of this Regulation. This Regulation should apply [2460 months] from its entry into force, with the exception of the reporting obligations concerning actively exploited vulnerabilities and incidents, which should apply [124 months] from the entry into force of this Regulation.

Amendment 200 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Recital 69

(69) Economic operators should be provided with a sufficient time to adapt to the requirements of this Regulation. This Regulation should apply [324 months] from its entry into force, with the exception of the reporting obligations concerning ~~actively~~known exploited vulnerabilities and incidents, which should apply [122 months] from the entry into force of this Regulation.

Amendment 201 #

Proposal for a regulation
Recital 69 a (new)

(69a) Economic operators that are SMEs, with particular attention paid to micro enterprises and start-ups, should be provided with dedicated guidance and where possible with financial support to adapt to the requirements of this Regulation when placing new product on the market. In particular, the Commission, ENISA and the Member States, should establish a European cyber resilience regulatory sandboxes, the Commission should establish a special webpage and provide direct tailored advice, and streamline the financial support from Digital Europe Programme and other relevant EU programmes. Member States should consider all possible complementary actions aiming at advice and financial support for SMEs, including via digital/cybersecurity hubs and start-up accelerators. Where the market surveillance authorities exercise their supervisory enforcement tasks, they should take into consideration whether the manufacturer is a SME, with particular attention payed to micro companies and start-ups.

Amendment 202 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Recital 69 a (new)

(69a) This Regulation may generate additional costs to micro, small and medium-sized enterprises. In order to support these enterprises that may face additional costs, the Commission should establish financial and technical support that allows for these companies to contribute to the European cybersecurity landscape.

Amendment 203 #

Proposal for a regulation
Recital 70 a (new)

(70a) This Regulation is without prejudice to the Member States’ prerogatives to take measures safeguarding national security, in compliance with Union law. Member States should be able to apply additional measures to products with digital elements that are used for military, defence or national security purposes.

Amendment 204 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 1 – paragraph 1 – point d

(d) rules on market monitoring, market surveillance and enforcement of the above- mentioned rules and requirements.

Amendment 205 #

Proposal for a regulation
Article 1 – paragraph 1 – point d

(d) rules on market monitoring, surveillance and enforcement of the above- mentioned rules and requirements.

Amendment 206 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 2 – paragraph 1

1. This Regulation applies to products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to an external device or network. This Regulation does not apply to the electronic communications networks as defined in Article 2, point (1), of Directive (EU) 2018/1972 in which products with digital elements are integrated.

Amendment 207 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA

Proposal for a regulation
Article 2 – paragraph 1

Amendment 208 #

Proposal for a regulation
Article 2 – paragraph 1

1. This Regulation applies to products with digital elements ~~whose intended or reasonably foreseeable use includes~~that have a direct or indirect logical or physical data connection to an external device or network.

Amendment 209 #

Proposal for a regulation
Article 2 – paragraph 1

1. This Regulation applies to products with digital elements whose intended ~~or reasonably foreseeable~~ use includes a direct or indirect logical or physical data connection to a device or network.

Amendment 210 #

Proposal for a regulation
Article 2 – paragraph 2 – point c a (new)

(ca) Regulation (EU) 2022/2554.

Amendment 211 #

Proposal for a regulation
Article 2 – paragraph 3

3. This Regulation does not apply to products with digital elements that have been certified in accordance with Regulation (EU) 2018/1139, nor to products with digital elements that are isolated from external devices and networks.

Amendment 212 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 2 – paragraph 3 a (new)

3a. This Regulation shall not apply to software provided under free and open- source licences, including its source code and modified versions, except when such software is provided as a paid or monetised product. The compliance of free and open-source components of products shall be ensured by the manufacturer of the product.

Amendment 213 #

4a. This regulation does not apply to spare parts that are exclusively manufactured in order to repair products with digital elements that have been placed on the market before the application date of this regulation referred to in Article 57.

Amendment 214 #

Proposal for a regulation
Article 2 – paragraph 5

5. This Regulation does not apply to products with digital elements developed exclusively for public security, national security, defence or military purposes or to products specifically designed to process classified information.

Amendment 215 #

Proposal for a regulation
Article 2 – paragraph 5 a (new)

5a. This Regulation does not apply to any supply of a product with digital elements for distribution and use on the Union market where such supply, distribution, and use exclusively occurs within the same group of companies within the meaning of Article 2(13) of Regulation (EU) 2015/848.

Amendment 216 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 2 – paragraph 5 a (new)

5a. This Regulation does not apply to free and open-source software, including its source code and modified versions, except when such software is provided in exchange for a price or as a monetised product with the intention of making a profit rather than performing maintenance.

Amendment 217 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI

Proposal for a regulation
Article 2 – paragraph 5 a (new)

5a. This regulation does not apply to free and open source software supplied outside the course of a commercial activity.

Amendment 218 #

Proposal for a regulation
Article 2 – paragraph 5 b (new)

5b. 6 (new) This Regulation does not apply to the internal networks of a product with digital elements if these networks have dedicated endpoints and are secured from external data connection.

Amendment 219 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 2 – paragraph 5 c (new)

5c. 7 (new) This Regulation shall not apply to spare parts intended solely to replace defective parts of products with digital elements, in order to restore their functionality.

Amendment 220 #

Proposal for a regulation
Article 3 – paragraph 1 – point 1

Amendment 221 #

Proposal for a regulation
Article 3 – paragraph 1 – point 1

(1) ‘product with digital elements’ means any software or hardware product ~~and its remote data processing solutions,~~ including software or hardware components to be placed on the market separately;

Amendment 222 #

Proposal for a regulation
Article 3 – paragraph 1 – point 1

Amendment 223 #

Proposal for a regulation
Article 3 – paragraph 1 – point 1 a (new)

(1a) ‘consumer product with digital elements’ means any product with digital elements’ to be placed on the market with default generic security configuration;

Amendment 224 #

Proposal for a regulation
Article 3 – paragraph 1 – point 1 b (new)

(1b) ‘business-to-business product with digital elements’ means any product with digital elements’ to be placed on the market with individual security configuration in accordance with contractual arrangements;

Amendment 225 #

Proposal for a regulation
Article 3 – paragraph 1 – point 2

(2) ‘remote data processing’ means any remote data processing ~~at a distance~~ for which the software is designed and developed by or for the manufacturer ~~or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its function~~, and is critical for the fundamental functions of the product with digital elements;

Amendment 226 #

Proposal for a regulation
Article 3 – paragraph 1 – point 3

(3) ‘critical product with digital elements’ means a product with digital elements that presents a cybersecurity risk in accordance with the criteria laid down in Article 6(2) and whose core functionality is set out in Annex III;deleted

Amendment 227 #

Proposal for a regulation
Article 3 – paragraph 1 – point 4

~~(4) ‘highly critical product with digital elements’ means a product with digital elements that presents a cybersecurity risk in accordance with the criteria laid down in Article 6(5);~~deleted

Amendment 228 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 3 – paragraph 1 – point 4 a (new)

(4a) ‘cybersecurity’ means cybersecurity as defined in Article 2, point (1), of Regulation (EU) 2019/881;

Amendment 229 #

Proposal for a regulation
Article 3 – paragraph 1 – point 6

(6) ‘software’ means the part of an electronic information system which consists of computer code, with exception of software relating to internet websites;

Amendment 230 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 3 – paragraph 1 – point 11

Amendment 231 #

Proposal for a regulation
Article 3 – paragraph 1 – point 16 a (new)

(16a) ‘micro, small and medium-sized enterprises’ or ‘SMEs’ means micro, small and medium-sized enterprises as defined in the Annex to Commission Recommendation 2003/361/EC;

Amendment 232 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 3 – paragraph 1 – point 18

Amendment 233 #

Proposal for a regulation
Article 3 – paragraph 1 – point 21 a (new)

(21a) 'consumer' means any natural person who, under the circumstances of this Regulation, is acting for purposes which are outside their trade, business, craft or profession.

Amendment 234 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 3 – paragraph 1 – point 21 a (new)

(21a) ‘micro, small and medium sized enterprises’ means micro, small and medium sized enterprises as defined in Commission Recommendation 2003/361/EC1a; _________________ 1a Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (notified under document number C(2003) 1422) (OJ L 124, 20.5.2003, p. 36).

Amendment 235 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 3 – paragraph 1 – point 21 b (new)

(21b) ‘provider of an online marketplace’ means a provider of an intermediary service using an online interface, which allows consumers to conclude distance contracts with traders for the sale of products;

Amendment 236 #

Proposal for a regulation
Article 3 – paragraph 1 – point 26

Amendment 237 #

Proposal for a regulation
Article 3 – paragraph 1 – point 31

(31) ‘substantial modification’ means a change to the product with digital elements following its placing on the market, which affects the compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I or results in a modification to the intended use for which the product with digital elements has been assessed, excluding security and maintenances updates that aim to mitigate vulnerabilities;

Amendment 238 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 3 – paragraph 1 – point 31

(31) ‘substantial modification’ means a change by the manufacturer to the product with digital elements following its placing on the market, ~~which~~beyond necessary security and maintenance updates, which results in modification of the product’s fundamental functions or its intended use and thus significantly affects the compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I ~~or results in a modification to the intended use for which the product with digital elements has been assessed~~;

Amendment 239 #

Proposal for a regulation
Article 3 – paragraph 1 – point 31

(31) ‘substantial modification’ means a change or a series of changes to the product with digital elements following its placing on the market, which affects the compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I or results in a modification to the intended use for which the product with digital elements has been assessed;

Amendment 240 #

Proposal for a regulation
Article 3 – paragraph 1 – point 34 a (new)

(34a) ‘international standard’ means an international standard as defined in Article 2, point (1)(a), of Regulation (EU) No 1025/2012;

Amendment 241 #

Proposal for a regulation
Article 3 – paragraph 1 – point 34 b (new)

(34b) ‘near miss’ means a near miss as defined in Article 6, point (5), of Directive (EU) 2022/2555;

Amendment 242 #

Proposal for a regulation
Article 3 – paragraph 1 – point 34 c (new)

(34c) ‘incident’ means an incident as defined in Article 6, point (6), of Directive (EU) 2022/2555;

Amendment 243 #

Proposal for a regulation
Article 3 – paragraph 1 – point 36 a (new)

(36a) ‘cyber threat’ means a cyber threat as defined in Article 2, point (10), of Regulation (EU) 2019/881;

Amendment 244 #

Proposal for a regulation
Article 3 – paragraph 1 – point 36 b (new)

(36b) ‘significant cyber threat’ means a significant cyber threat as defined in Article 2, point (11), of Regulation (EU) 2019/881;

Amendment 245 #

Proposal for a regulation
Article 3 – paragraph 1 – point 37

(37) ‘software bill of materials’ or ‘SBOM’ means a formal record containing details and supply chain relationships of components included in the software elements of a product with digital elements;

Amendment 246 #

Proposal for a regulation
Article 3 – paragraph 1 – point 39

(39) ‘actively exploited vulnerability’ means a vulnerability for which there is reliable evidence that execution of malicious code was performed by an actor on a system without permission of the system owner; but does not include a vulnerability for which there is reliable evidence that the exploitation was performed by an actor for purposes of good faith testing, investigation, correction, or disclosure of a security flaw or vulnerability to promote the security or safety of the system owner, computers or software, or those who use such computers or software;

Amendment 247 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 3 – paragraph 1 – point 39

(39) ‘~~actively~~known exploited vulnerability’ means a patched vulnerability for which ~~there is~~ reliable evidence exists that execution of malicious code was performed by an actor on a system without permission of the system owner;

Amendment 248 #

Proposal for a regulation
Article 3 – paragraph 1 – point 39 – point a (new)

a) ‘expected product lifetime’ means the lifetime a manufacturer documents in the information and instructions to the user defined in Annex II (8). For software it includes the iterated modifications within the version that was placed in the market.

Amendment 249 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 3 – paragraph 1 – point 39 a (new)

(39a) ‘incident’ means an incident as defined in Article 6, point (6), of Directive (EU) 2022/2555;

Amendment 250 #

Proposal for a regulation
Article 4 – paragraph 2

Amendment 251 #

Proposal for a regulation
Article 4 – paragraph 3

Amendment 252 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 4 – paragraph 3

Amendment 253 #

Proposal for a regulation
Article 4 – paragraph 3

3. Member States shall not prevent the making available of unfinished software which does not comply with this Regulation provided that the software is only made available in a non-production version for a limited period required for testing purposes, including software labelled as “beta,” “pre-release,” or “candidate", and that a visible sign clearly indicates that it does not comply with this Regulation and will not be available on the market for purposes other than testing.

Amendment 254 #

Proposal for a regulation
Article 4 – paragraph 3 a (new)

3a. This Regulation shall not prevent Member States from applying additional measures to products with digital elements provided that such measures are proportionate and aim to safeguard products, infrastructure or processed information and provided that those specific products are used for critical system functions or critical components deployed in sectors of high criticality as set out in Annex I to Directive (EU) 2022/2555.

Amendment 255 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 5 – paragraph 1 – point 1

Amendment 256 #

Proposal for a regulation
Article 6 – paragraph 1

1. Products with digital elements that belong to a category which is listed in Annex III shall be considered critical products with digital elements. POnly products which have the core functionality of a category that is listed in Annex III to this Regulation shall be considered as falling into that category. Categories of critical products with digital elements shall be divided into class I and class II as set out in Annex III, reflecting the level of cybersecurity risk related to these products. The integration of a component of higher class of criticality does not change the level of criticality for the product the component is integrated into.

Amendment 257 #

Proposal for a regulation
Article 6 – paragraph 2 – introductory part

2. TOn the basis of the reports referred to in Article 56 and after consulting the Cyber Resilience Expert Group, ADCO, ENISA, and, where necessary, other relevant stakeholders, the Commission is empowered to adopt delegated acts, in accordance with Article 50 to amend Annex III by including in the list of categories of critical products with digital elements a new category or withdrawing an existing one from that list. When assessing the need to amend the list in Annex III, the Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements. In determining the level of cybersecurity risk, one or several of the following criteria shall be taken into account:

Amendment 258 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 6 – paragraph 2 – introductory part

2. The Commission is empowered to adopt delegated acts in accordance with Article 50 to amend Annex III by including in the list of categories of critical products with digital elements a new category or withdrawing an existing one from that list. The Commission should carry out periodical checks to assess whether the list of critical products with digital elements needs to be integrated or updated. When assessing the need to amend the list in Annex III, the Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements. In determining the level of cybersecurity risk, one or several of the following criteria shall be taken into account:

Amendment 259 #

Amendment 260 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 6 – paragraph 3

3. The Commission is empowered to adopt a delegated act in accordance with Article 50 to supplement this Regulation by specifying the definitions of the product categories under class I and class II as set out in Annex III. ~~The delegated act shall be adopted [by 12 months since the entry into force of this Regulation].~~ If it expands the scope of the product categories, the procedure in paragraph 2 should be followed. The delegated act shall be adopted [by 12 months since the entry into force of this Regulation]. The Commission shall establish a process under which a product which is a candidate to be a critical product can be reviewed in a collaborative process by all relevant stakeholders, including manufacturers and users, to assess the security risk posed by potential cybersecurity issues with the product, whether and how much designating the product as critical would likely reduce that risk, and the costs associated with designating the product as critical. If such assessment clearly establishes that designating that product as critical would materially reduce the security risk posed to the users of the product and that the value of such reduction would outweigh the costs to the manufacturer and other parties, the product may be designated as critical under this Regulation.

Amendment 261 #

Proposal for a regulation
Article 6 – paragraph 3

Amendment 262 #

Proposal for a regulation
Article 6 – paragraph 3

Amendment 263 #

Proposal for a regulation
Article 6 – paragraph 4

Amendment 264 #

Proposal for a regulation
Article 6 – paragraph 5

~~5. The Commission is empowered to adopt~~ delegated acts in accordance with Article 50 to supplement this Regulation by specifying categories of highly critical products with digital elements for which the manufacturers shall be required to obtain a European cybersecurity certificate under a European cybersecurity certification scheme pursuant to Regulation (EU) 2019/881 to demonstrate conformity with the essential requirements set out in Annex I, or parts thereof. When determining such categories of highly critical products with digital elements, the Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements, in light of one or several of the criteria listed in paragraph 2, as well as in view of the assessment of whether that category of products is: (a) used or relied upon by the essential entities of the type referred to in Annex [Annex I] to the Directive [Directive XXX/ XXXX (NIS2)] or will have potential future significance for the activities of these entities; or (b) relevant for the resilience of the overall supply chain of products with digital elements against disruptive events.

Amendment 265 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 6 – paragraph 5

~~5. The Commission is empowered to adopt~~ delegated acts in accordance with Article 50 to supplement this Regulation by specifying categories of highly critical products with digital elements for which the manufacturers shall be required to obtain a European cybersecurity certificate under a European cybersecurity certification scheme pursuant to Regulation (EU) 2019/881 to demonstrate conformity with the essential requirements set out in Annex I, or parts thereof. When determining such categories of highly critical products with digital elements, the Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements, in light of one or several of the criteria listed in paragraph 2, as well as in view of the assessment of whether that category of products is: (a) used or relied upon by the essential entities of the type referred to in Annex [Annex I] to the Directive [Directive XXX/ XXXX (NIS2)] or will have potential future significance for the activities of these entities; or (b) relevant for the resilience of the overall supply chain of products with digital elements against disruptive events.

Amendment 266 #

Proposal for a regulation
Article 6 – paragraph 5 – introductory part

5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by specifying categories of highly critical products with digital elements for which the manufacturers shall be required to obtain a European cybersecurity certificate under a European cybersecurity certification scheme at assurance level "high" pursuant to Regulation (EU) 2019/881 to demonstrate conformity with the essential requirements set out in Annex I, or parts thereof. When determining such categories of highly critical products with digital elements, the Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements, in light of one or several of the criteria listed in paragraph 2, as well as in view of the assessment of whether that category of products is:

Amendment 267 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 9 – paragraph 1 – subparagraph 1 (new)

Internal networks of a machinery product with digital elements are not subject to this Regulation when they are secured via dedicated endpoints and isolated from external networks, and where the manufacturer assess and indicate the intended final use of the component for the sole internal operations and communication.

Amendment 268 #

Zdzisław KRASNODĘBSKI, Adam BIELAN, Kosma ZŁOTOWSKI

Proposal for a regulation
Article 10 – paragraph -1 (new)

Amendment 269 #

Proposal for a regulation
Article 10 – paragraph 1

1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential requirements set out in Section 1 of Annex I. Manufacturers may deviate from a requirement in justified cases if it does not apply due to the nature of the product. Manufacturers should document the justification in the cybersecurity risks assessment in accordance to paragraph 2.

Amendment 270 #

Proposal for a regulation
Article 10 – paragraph 1

1. When placing a product with digital elements on the market, manufacturers shall ensure take reasonable measures that it has been designed, developed and produced in accordance with the essential requirements set out in Section 1 of Annex I.

Amendment 271 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 10 – paragraph 2

Amendment 272 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 10 – paragraph 4

4. For the purposes of complying with the obligation laid down in paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties in products with digital elements. ~~They shall~~It falls upon the manufacturer to ensure that such components do not compromise the security of the product with digital elements, in particular in the case of open source software that have not been placed on the market in exchange of financial or other type of monetisation, including data returns. The due diligence obligation can be considered fulfilled if all components have been already deemed compliant and the CE mark has been affixed to them as appropriate.

Amendment 273 #

Proposal for a regulation
Article 10 – paragraph 4

4. For the purposes of complying with the obligation laid down in paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties in products with digital elements, including when they integrate components of open-source software that have not been supplied in the course of a commercial activity. They shall ensure that such components do not compromise the security of the product with digital elements.

Amendment 274 #

Proposal for a regulation
Article 10 – paragraph 4

Amendment 275 #

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

When placing a product with digital elements on the market, and for the expected product lifetime or for a period of five years from the placing of the product on the market, whichever is shorter, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Sectfor a period of at least five years or the expected product lifetime or, whichever is longer, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I. In the case of small and micro enterprises this obligation and the obligation foreseen in Article 10(12) are limited to the expected product lifetime as determined by the manufacturer, taking into account the reasonable expectations of consumers regarding the functionality, intended purpose of the product, and the provision of security and functionality updates. In any case, the end users must be informed of the minimal duration that a product will benefit from security updates, before purchase. Manufacturers shall have appropriate policies and procedures, including coordinated vulnerability disclosure policies, referred to in Section 2, point (5), of Annex I, to process and remediate potential vulnerabilities in the product with digital elements reported from internal or external sources. Those procedures shall differentiate between security updates that provide devices with enhanced security, including security patches and corrective or functionality updates that provide corrective or new functionalities, including corrective patches, establishing that these updates should be provided separately, unless clearly demonstrated that it is not technically possible. The end user shall always retain the possibility to revert to a previous version 2 of ~~Annex I.~~ functionality updates.

Amendment 276 #

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

When placing a product with digital elements on the market, and for the expected product lifetime indicated by the manufacturer, or for a period of five years from the placing of the product on the market, whichever is shorter, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I. The Commission may, after consulting the Cyber Resilience Expert Group, ADCO, ENISA, and, where necessary, other relevant stakeholders, by means of implementing acts, specify the format and information of the label for consumer products with digital elements, which might easily indicate the expected lifetime of the product. On top of that, this label might contain additional information enabling consumers to quickly understand the level of security and privacy associated with the product. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 51(2).

Amendment 277 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

When placing a product with digital elements on the market, ~~and for~~the manufacturer shall define the expected product lifetime or for a period of five years from the placing of the product on the market, whichever is shorter, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I. In doing so, the manufacturer shall ensure that expected product lifetime is in line with reasonable consumer expectations and that it promotes sustainability and the need to ensure long-lasting products with digital elements. Manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I during at least the expected product lifetime or 10 years, whichever is shorter. Where applicable, the expected product lifetime shall be clearly stated on the product, its packaging or be included in contractual agreements.

Amendment 278 #

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

WManufacturers shall ensure, when placing a product with digital elements on the market, and for the expected product lifetime ~~or for a period of five years from the placing of the product on the market, whichever is shorter, manufacturers shall ensure that vulnerabilities of that product are handled effectively and~~, that vulnerabilities of that product or of its iterated versions during its lifetime are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I. Manufacturers shall determine the expected product lifetime referred to in the first subparagraph of this paragraph taking into acco~~rdance wi~~unt the t~~he essential requirements set out in Section 2 of Annex I.~~ime users reasonably expect to be able to use the product given its functionality and intended purpose and therefore can expect to receive security updates

Amendment 279 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

WManufacturers shall ensure, when placing a product with digital elements on the market, and for the expected product lifetime ~~or for a period of five years from the placing of the product on the market, whichever is shorter, manufacturers shall ensure that vulnerabilities of that product are handled effectively and~~ , that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I. The expected product lifetime shall not be less than five years for products covered by Directive 2009/125/EC of the European Parliament and of the Council1a. _________________ 1a Directive 2009/125/EC of the European Parliament and of the Council of 21 October 2009 establishing a~~ccordance with the essential requirements set out in Section 2 of Annex I.~~ framework for the setting of ecodesign requirements for energy-related products (OJ L 285, 31.10.2009, p. 10).

Amendment 280 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

Amendment 281 #

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1

Amendment 282 #

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1 a (new)

Manufacturers shall determine the expected product lifetime referred to in the first subparagraph of this paragraph taking into account the time users reasonably expect to be able to use the product given functionality and intended purpose and therefore can expect to receive security updates.

Amendment 283 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 2 a (new)

Manufacturers shall determine the expected product lifetime referred to in the first subparagraph of this paragraph, taking into account the time users reasonably expect to be able to use the product given its functionality and intended purpose, and therefore can expect to receive security updates.

Amendment 284 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 10 – paragraph 7 – subparagraph 1

Before placing a product with digital elements on the market, manufacturers shall draw up the technical documentation referred to in Article 23. The technical documentation shall be made available by the manufacturers, to the market surveillance authorities or CSIRTs, upon justified request, for the purpose of specific supervisory tasks and incident handling set in this Regulation. Those authorities shall ensure the confidentiality and appropriate protection of the information provided in the technical documentation.

Amendment 285 #

Proposal for a regulation
Article 10 – paragraph 8

8. Manufacturers shall keep the technical documentation and the EU declaration of conformity, where relevant, at the disposal of the market surveillance authorities for ten years, or for the expected product lifetime, whichever is longer, after the product with digital elements has been placed on the market.

Amendment 286 #

Proposal for a regulation
Article 10 – paragraph 8

Amendment 287 #

8. Manufacturers shall keep the technical documentation and the EU declaration of conformity, ~~where relevant,~~ at the disposal of the market surveillance authorities for ten years after the product with digital elements has been placed on the market.

Amendment 288 #

Proposal for a regulation
Article 10 – paragraph 9

9. Manufacturers shall ensure that procedures are in place for products with digital elements that are part of a series of production to remain in conformity. The manufacturer shall adequately take into account changes in the development and production process or in the design or characteristics of the product with digital elements and changes in the harmonised or international standards, European cybersecurity certification schemes or the common specifications referred to in Article 19 by reference to which the conformity of the product with digital elements is declared or by application of which its conformity is verified. Where new knowledge, techniques, or standards become available, which were not available at the time of design of a serial product, the manufacturer may consider implementing such improvements for future product generations. The manufacturer shall take into account the associated costs and efforts, including the efforts required for development, testing, validation and approval process time.

Amendment 289 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 10 – paragraph 9

Amendment 290 #

Proposal for a regulation
Article 10 – paragraph 9

Amendment 291 #

Proposal for a regulation
Article 10 – paragraph 9 a (new)

9a. Manufacturers shall publicly communicate and advertise the expected product lifetime of their products, in a clear and understandable manner, and in particular, the minimal duration of the provision of security updates.

Amendment 292 #

Proposal for a regulation
Article 10 – paragraph 10

10. Manufacturers shall ensure that products with digital elements are accompanied by the information and instructions set out in Annex II, in an electronic or physical form. Such information and instructions shall be in a language which can be easily understood by users. They shall be clear, understandable, intelligible and legible. They shall allow for a secure installation, operation and use of the products with digital elements. The expected product lifetime shall be communicated and advertised in a clear manner by the manufacturers, and where feasible the expected lifetime shall be clearly demonstrated on the packaging of the product.

Amendment 293 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 10 – paragraph 10 a (new)

10a. Manufacturers shall clearly and understandably specify in an easily accessible manner and where applicable on the packaging of the product with digital elements, the end date for the expected product lifetime as referred to in paragraph 6, including at least the month and year, until which the manufacturer will at least ensure the effective handling of vulnerabilities in accordance with the essential requirements set out in Section 2 of Annex I.

Amendment 294 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 10 – paragraph 10 a (new)

10a. Manufacturers shall clearly specify in an easily accessible manner, and where applicable, on the packaging of the product with digital elements, the end date for the expected product lifetime as referred to in paragraph 6, including at least the month and year, until which the manufacturer will at least ensure the effective handling of vulnerabilities in accordance with the essential requirements set out in Section 2 of Annex I.

Amendment 295 #

Proposal for a regulation
Article 10 – paragraph 12

Amendment 296 #

Proposal for a regulation
Article 10 – paragraph 12

12. From the placing on the market and for the expected product lifetime indicated by the manufacturer in accordance with paragraph 6 of this Article, or for a period of five years after the placing on the market of a product with digital elements, whichever is shorter, manufacturers who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the manufacturer’s processes into conformity, to withdraw or to recall the product, as appropriate.

Amendment 297 #

Proposal for a regulation
Article 10 – paragraph 12

12. From the placing on the market and for the entire expected ~~product lifetime or for a period of five years after the placing on the market~~lifespan of a product with digital elements, ~~whichever is shorter,~~ manufacturers who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the manufacturer’s processes into conformity, to withdraw or to recall the product, as appropriate.

Amendment 298 #

Proposal for a regulation
Article 10 – paragraph 12

12. From the placing on the market ~~and for the expected product lifetime or~~ for a period of at least five years ~~afte~~or for the ~~placing on the market of a product with digital elements~~expected product lifetime, whichever is ~~short~~longer, manufacturers who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the manufacturer’s processes into conformity, to withdraw or to recall the product, as appropriate.

Amendment 299 #

Proposal for a regulation
Article 10 – paragraph 13 a (new)

13a. For the purposes of complying with the obligations laid down in this Regulation, manufacturers shall ensure that they use adequate skilled professionals in the field of cybersecurity.

Amendment 300 #

Proposal for a regulation
Article 10 – paragraph 15

15. The Commission may, by means of implementing acts, and following an open consultation with stakeholders and in line with international standards, specify the format and elements of the software bill of materials set out in Section 2, point (1), of Annex I. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 51(2).

Amendment 301 #

Proposal for a regulation
Article 10 – paragraph 15

Amendment 302 #

Proposal for a regulation
Article 10 – paragraph 15

15. The Commission may, ~~by means of implementing act~~after consulting the Cyber Resilience Expert Group, ADCO, ENISA, and, where necessary, other relevant stakeholders, by means of guidelines, specify the recommended format and elements of the ~~software bill of material~~SBOMs set out in Section 2, point (1), of Annex I~~. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 51(2)~~, based on international standards and established best practices.

Amendment 303 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 10 – paragraph 15

15. The Commission may, by means of ~~implementing~~delegated acts, specify the format and elements of the software bill of materials set out in Section 2, point (1), of Annex I. Those ~~implementing~~delegated acts shall be adopted in accordance with ~~the examination procedure referred to in~~ Article 5~~1(2)~~0.

Amendment 304 #

Proposal for a regulation
Article 10 a (new)

Article10a Reporting of vulnerabilities 1. The manufacturer shall, without undue delay, notify to CSIRT in the Member State of main establishment designated as a coordinator for the purposes of coordinated vulnerability disclosure in accordance with Article 12(1) of Directive 2022/2555 of Member States concerned any patched vulnerability contained in the product with digital elements and may voluntarily notify, where appropriate, also the unpatched vulnerability. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken, in particular regarding available patches. The mere act of notification of vulnerability shall not subject the notifying manufacturer to increased liability. CSIRT designated as a coordinator shall, without undue delay, unless for justified cybersecurity risk- related grounds, forward the notification to the upon receipt to ENISA and inform the market surveillance authorities concerned about the notified vulnerability. 2. The information about vulnerability shall be stored in a European vulnerability database referred to in Article 12(2) of Directive 2022/2555, maintained by ENISA. That database shall include: (a) information describing the vulnerability; (b) the affected product with digital elements and the severity of the vulnerability in terms of the circumstances under which it may be exploited; (c) the availability of related patches and, in the absence of available patches, guidance provided by the competent authorities or the CSIRTs addressed to users of vulnerable product with digital elements as to how the risks resulting from disclosed vulnerabilities can be mitigated. 3. Natural or legal persons shall be able to report, anonymously where they so request, a vulnerability of product with digital elements to the CSIRT designated as coordinator. The CSIRT designated as coordinator shall without undue delay notify the manufacturer, ensure that diligent follow-up action is carried out with regard to the reported vulnerability and shall ensure the anonymity of the natural or legal person reporting the vulnerability. Where the reporting concerns the manufacturer with main establishment in other Member State, the CSIRT designated as coordinator shall forward it to relevant CSIRT designated as coordinator in that Member State. Where a reported vulnerability could have a significant impact on entities in more than one Member State, the CSIRT designated as coordinator of each Member State concerned shall, where appropriate, cooperate with other CSIRTs designated as coordinators within the CSIRTs network.

Amendment 305 #

Proposal for a regulation
Article 11 – title

Reporting o~~bligations of manufacturer~~f incidents

Amendment 306 #

Proposal for a regulation
Article 11 – paragraph 1

1. The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited vulnerability contained in the product with digital elements. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of Member States concerned upon receipt and inform the market surveillance authority about the notified vulnerability.deleted

Amendment 307 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 11 – paragraph 1

1. The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any ~~actively~~known exploited vulnerability contained in the product with digital elements in accordance with paragraph 1a of this Article. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive ~~[Directive XXX/XXXX~~(EU) 2022/2555 (NIS2)] of Member States concerned upon receipt and inform the market surveillance authority about the notified vulnerability. Where a notified vulnerability has no corrective or mitigating measures available, ENISA shall ensure that the sharing of information regarding the notified vulnerability is based on applicable security protocols and on a need-to-know- basis.

Amendment 308 #

Proposal for a regulation
Article 11 – paragraph 1

1. The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited vulnerability contained in the product with digital elements. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken and the recommended risk mitigation measures. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of Member States concerned upon receipt and inform the market surveillance authority about the ~~notified vulnerability~~existence of a vulnerability and where applicable, the potential risk mitigation measures .

Amendment 309 #

Proposal for a regulation
Article 11 – paragraph 1

1. The manufacturer shall, without undue delay and in any event within 724 hours ~~of becoming aware of it, notify to ENISA any actively exploit~~after the patch is publicly available, notify to CSIRT Network any new patched vulnerabilityies contained in the product with digital elements that may be actively exploited and pose a significant cybersecurity risk. The notification shall include basic details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of Member States concerned upon receipt and inform the market surveillance authority about the notified vulnerability based on the manufacturers coordinated vulnerability disclosure policy required by section 2 of Annex I item (5) (e.g., the ISO/IEC 29147).

Amendment 310 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 11 – paragraph 1 a (new)

1a. 1a. Notifications as referred to in paragraph 1 shall be subject to the following procedure: (a) an early warning, without undue delay and in any event within 24 hours of the manufacturer becoming aware of the known exploited vulnerability, detailing whether any known corrective or mitigating measure is available; (b) a vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the known exploited vulnerability, which, where applicable, updates the information referred to in point (a), details any corrective or mitigating measures taken and indicates an assessment of extent of the vulnerability, including its severity and impact; (c) an intermediate report on relevant status updates, upon the request of ENISA; (d) a final report, within one month after the submission of the vulnerability notification under point (b), including at least the following: (i) a detailed description of the vulnerability, including its severity and impact; (ii) where available, information concerning any actor that has exploited or that is exploiting the vulnerability; (iii) details about the security update or other corrective measures that have been made available to remedy the vulnerability.

Amendment 311 #

Angelika NIEBLER

Proposal for a regulation
Article 11 – paragraph 1 a (new)

1a. Manufacturers shall submit to ENISA a vulnerability notification within 72 hours of becoming aware of the actively exploited vulnerability, which, where applicable, shall update the information that was given in the early warning, especially on the corrective or mitigating measures taken.

Amendment 312 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 11 – paragraph 1 b (new)

1b. Once a security update has been made available, or an appropriate corrective or mitigation measure has been implemented, ENISA shall add the notified vulnerability to the European vulnerability database referred to in Article 12 of Directive [Directive 2022/2555 (NIS2)].

Amendment 313 #

Proposal for a regulation
Article 11 – paragraph 2

2. The manufacturer shall notify, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA its CSIRT in the Member State of main establishment of any incident tha~~ving~~t has a significant impact on the security of the product with digital elements as referred to in paragraph 2a (significant incident). ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notifications to the single point of contact designated in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of the Member States concerned and inform the market surveillance authority about the notified incidents. The incident notification shall include information on the severity and impact of the incident and, where applicable, indicate whether the manufacturer suspects the incident to be caused by unlawful or malicious acts or considers it to have a cross-border impact. The mere act of notification shall not subject the notifying manufacturer to increased liability. On a voluntary basis, the manufacturer may notify also other than significant incidents, cyber threats and near misses.

Amendment 314 #

Proposal for a regulation
Article 11 – paragraph 2

2. The manufacturer shall, ~~without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any~~notify the designated CSIRT or single point of contact, in accordance to the procedure of Directive [Directive XXX.XXXX NIS2], any significant incident having impact on the security of the product with digital elements. ~~ENISA~~The single point of contact shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notifications to the single point of contact designated in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of the Member States concerned and inform the market surveillance authority about the notified incidents. The incident notification shall include information on the severity and impact of the incident and, where applicable, indicate whether the manufacturer suspects the incident to be caused by unlawful or malicious acts or considers it to have a cross-border impact.

Amendment 315 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Angelika NIEBLER, Adam JARUBAS

Proposal for a regulation
Article 11 – paragraph 2

2. The manufacturer shall~~, without undue delay and in any event within 24 hours of becoming aware of it,~~ notify to ENISA any significant incident having impact on the security of the product with digital elements in accordance with paragraph 2b of this Article. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notifications to the single point of contact designated in accordance with Article [Article X] of Directive ~~[Directive XXX/XXXX~~(EU) 2022/2555 (NIS2)] of the Member States concerned and inform the market surveillance authority about the notified significant incidents. The significant incident notification shall include ~~information on the severity and impact of the incident and, where applicable, indicate whether the manufacturer suspects the incident to be caused by unlawful or malicious acts or considers~~ the necessary information to make the competent authority aware of the incident and allow for the entity to ~~have a cross-border impact~~seek assistance.

Amendment 316 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 11 – paragraph 2 a (new)

2a. An incident shall be considered to be significant, where: (a) it has caused or is capable of causing severe operational disruption of the production or the services for the manufacturer concerned, which would impact the security of a product; or (b) it has affected or is capable of affecting other natural or legal persons by causing considerable material or non- material damage.

Amendment 317 #

Proposal for a regulation
Article 11 – paragraph 2 a (new)

2a. An incident shall be considered to be significant if: (a) it has caused or is capable of causing severe operational disruption of the design, development, production or functioning of the product with digital elements or financial loss for the manufacturer concerned; (b) it has affected or is capable of affecting other natural or legal persons by causing considerable material or non- material damage.

Amendment 318 #

Proposal for a regulation
Article 11 – paragraph 2 a (new)

2a. Economic operators that are also identified as essential entities or important entities under the Directive [ Directive XXX.XXXX NIS2 ] and who submit their incident notification pursuant to the Directive [ Directive XXX.XXXX NIS2 ] should be deemed compliant with the requirements in point 2 of this Article. Moreover, an entity may only be fined once for non-compliance to overlapping reporting requirements.

Amendment 319 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 11 – paragraph 2 b (new)

2b. Notifications as referred to in paragraph 2 shall be subject to the following procedure: (a) an early warning, without undue delay and in any event within 24 hours of the manufacturer becoming aware of the significant incident, which, where applicable, indicates whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact; (b) an incident notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the significant incident, which, where applicable, updates the information referred to in point (a) and indicates an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise; (c) an intermediate report on relevant status updates upon the request of ENISA; (d) a final report, within one month after the submission of the incident notification under point (b), including at least the following: (i) a detailed description of the incident, including its severity and impact; (ii) the type of threat or root cause that is likely to have triggered the incident; (iii) applied and ongoing mitigation measures; (iv) where applicable, the cross-border impact of the incident; In the event of an ongoing incident at the time of the submission of the final report referred to in point (d) of the first subparagraph, Member States shall ensure that entities concerned provide a progress report at that time and a final report within one month of their handling of the incident.

Amendment 320 #

Proposal for a regulation
Article 11 – paragraph 2 b (new)

2b. For the purpose of notification under paragraph 1, the manufacturers concerned submit to the CSIRT: (a) without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross- border impact; (b) without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, which, where applicable, shall update the information referred to in point (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise; (c) upon the request of a CSIRT an intermediate report on relevant status updates; (d) a final report not later than one month after the submission of the incident notification under point (b), including the following: (i) a detailed description of the incident, including its severity and impact; (ii) the type of threat or root cause that is likely to have triggered the incident; (iii) applied and ongoing mitigation measures; (iv) where applicable, the cross-border impact of the incident; (e) in the event of an ongoing incident at the time of the submission of the final report referred to in point (d), Member States shall ensure that entities concerned provide a progress report at that time and a final report within one month of their handling of the incident.

Amendment 321 #

Proposal for a regulation
Article 11 – paragraph 2 c (new)

2c. CSIRT shall, without undue delay, unless for justified cybersecurity risk- related grounds, inform the market surveillance authority about the notified incidents and in the case of a cross-border significant incident forward the notifications to the single point of contact designated in accordance with Article 8(3) of Directive (EU) 2022/2555.

Amendment 322 #

Proposal for a regulation
Article 11 – paragraph 3

3. ~~ENISA~~CSIRT shall submit to the European cyber crisis liaison organisation network (EU-CyCLONe) established by Article 16[Article X] of Directive (EU) 2022/2555 [Directive XXX/XXXX (NIS2)] information notified pursuant to paragraphs 1 and 2 if such information is relevant for the coordinated management of large-scale cybersecurity incidents and crises at an operational level.

Amendment 323 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 11 – paragraph 3 a (new)

3a. ENISA shall publish and maintain a known exploited vulnerability catalogue that shall be included in the European vulnerability database established under Directive 2022/2555 (NIS2). The catalogue shall assist manufacturers in detecting known exploitable vulnerabilities and notify vulnerabilities found in their products.

Amendment 324 #

Proposal for a regulation
Article 11 – paragraph 4

4. TWhere appropriate, the manufacturer shall inform, without undue delay and after becoming aware, the users of the product with digital elements about the ~~incident~~significant incident having major impact on the security of the product concerned, and, where necessary, about corrective measures that the user can deploy to mitigate the impact of the significant incident.

Amendment 325 #

Proposal for a regulation
Article 11 – paragraph 4

4. The manufacturer shall inform, without undue delay and after becoming aware, the impacted users of the product with digital elements about the incident ~~and, where necessary~~having significant impact and, where necessary may inform all users of the product with digital elements, about corrective measures that the user can deploy to mitigate the impact of the incident.

Amendment 326 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 11 – paragraph 4

4. The manufacturer shall inform, without undue delay and after becoming aware, the users of the product with digital elements about the significant incident and, where necessary, about corrective measures that the user can deploy to mitigate the impact of the significant incident.

Amendment 327 #

Proposal for a regulation
Article 11 – paragraph 4

Amendment 328 #

Proposal for a regulation
Article 11 – paragraph 4 a (new)

4a. The CSIRT shall provide, without undue delay and where possible within 24 of receiving the early warning referred to in paragraph 4, point (a), a response to the notifying entity, including initial feedback on the significant incident and, upon request of the entity may provide guidance or operational advice on the implementation of possible mitigation measures. The CSIRT may provide additional technical support if the manufacturer concerned so requests. Where the significant incident is suspected to be of criminal nature, the CSIRT shall provide guidance on reporting the significant incident to law enforcement authorities. CSIRTs may prioritise the processing of mandatory notifications over voluntary notifications, as well as processing of notifications related to critical products with digital elements over other products with digital elements.

Amendment 329 #

Proposal for a regulation
Article 11 – paragraph 4 b (new)

4b. As appropriate, the CSIRT shall inform market surveillance authority concerned and forward to it, on request, relevant information, on the incident handling, particularly as regards the final report referred to in paragraph 2b(e) of this Article.

Amendment 330 #

Proposal for a regulation
Article 11 – paragraph 4 c (new)

4c. Where appropriate, and in particular where the significant incident concerns two or more Member States, the CSIRT, the competent authority or the single point of contact shall inform, without undue delay, the other affected Member States and ENISA of the significant incident. Such information shall include the type of information received in accordance with paragraph 2b. In so doing, the CSIRT or the single point of contact shall, in accordance with Union or national law, preserve the entity’s security and commercial interests as well as the confidentiality of the information provided.

Amendment 331 #

Proposal for a regulation
Article 11 – paragraph 4 d (new)

4d. Where public awareness is necessary to prevent a significant incident or to deal with an ongoing significant incident, or where disclosure of the significant incident is otherwise in the public interest, a Member State’s CSIRT or, where applicable, its competent authority, and, where appropriate, the CSIRTs or the competent authorities of other Member States concerned, may, after consulting the entity concerned, inform the public about the significant incident or require the entity to do so

Amendment 332 #

Proposal for a regulation
Article 11 – paragraph 4 e (new)

4e. At the request of the CSIRT or the competent authority, the single point of contact shall forward notifications received pursuant to paragraph 1 to the single points of contact of other affected Member States.

Amendment 333 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 11 – paragraph 5

5. The Commission ~~may, by means of implementing acts, specify further~~is empowered to adopt delegated acts, in accordance with Article 50, to further specify the type of information, format and procedure of the notifications submitted pursuant to paragraphs 1 and 2. Those ~~implementing~~delegated acts shall be adopted ~~in accordance with the examination procedure referred to in Article 51(2)~~within 9 months of entry into force of this Regulation.

Amendment 334 #

Proposal for a regulation
Article 11 – paragraph 5 a (new)

5a. The Commission may adopt, after consulting stakeholders and CSIRTs Network, by means of implementing acts, further specifying further the type of information, format and the procedure of the a notifications and submitted pursuant to paragraphs 1 and 2 of this Article and of a information submitted pursuant to paragraph 4 of this Article and common notification templates for the single reporting under relevant EU law in accordance with Article 11a. Those implementing acts shall be based, where relevant, on European and international standards and shall be adopted in accordance with the examination procedure referred to in Article 51(2).

Amendment 335 #

Proposal for a regulation
Article 11 – paragraph 7

7. Manufacturers shall, upon identifying a vulnerability in a component, including in an open source component, which is integrated in the product with digital elements, report the vulnerability and the corrective or mitigating measure taken, to the person or entity maintaining the component. Such corrective or mitigating measures shall be accompanied by the relevant code and appropriate licenses that allow the deployment. This does not release the manufacturer from the obligation to maintain the compliance of the product with the requirements of this regulation, nor does it create obligations for the developers of free and open source components that have no contractual relation to the said manufacturer.

Amendment 336 #

Proposal for a regulation
Article 11 – paragraph 7

7. Manufacturers shall, upon identifying a vulnerability in a component, including in an open source component, which is integrated in the product with digital elements, report the vulnerability to the person or entity maintaining the component. Software modifications in a component developed by manufacturers in order to address reported vulnerabilities shall be shared, including the relevant code, to the person or entity maintaining the component.

Amendment 337 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Angelika NIEBLER

Proposal for a regulation
Article 11 – paragraph 7 a (new)

7a. ENISA shall establish a digital reporting mechanism, after having consulted relevant stakeholder groups, so that manufacturers are able to fulfil their reporting obligations via an Online Application.

Amendment 338 #

Proposal for a regulation
Article 11 a (new)

Article11a Single point of contact for users 1. Manufacturers shall designate a single point of contact to enable users to communicate directly and rapidly with them, where applicable by electronic means and in a user-friendly manner, including by allowing recipients of the service to choose the means of communication, which shall not solely rely on automated tools. 2. In addition to the obligations provided under Directive 2000/31/EC, manufacturers shall make public the information necessary for the end users in order to easily identify and communicate with their single points of contact. That information shall be easily accessible and shall be kept up to date.

Amendment 339 #

Proposal for a regulation
Article 11 a (new)

Article11a Single Entry Point For the purpose of simplifying reporting and of implementing the automatic and direct reporting and forwarding mechanism under Articles 10a and 11 this Regulation, Directive (EU) 2022/2555, and possibly under other relevant EU legislation, such as Regulation (EU) 2016/679, Member States shall establish and use a single entry point.

Amendment 340 #

Proposal for a regulation
Article 12 – paragraph 1

1. A manufacturer may appoint an authorised representative(s) for all Member States markets or for specific Member States by a written mandate.

Amendment 341 #

Proposal for a regulation
Article 13 – paragraph 2 – point c a (new)

(ca) Non-technical risk factors of the manufacturer are taken into consideration for critical products described in Class II of Annex III intended for the use by essential entities of the type referred to in [Annex I to the Directive XXX/XXXX (NIS2)];

Amendment 342 #

Proposal for a regulation
Article 13 – paragraph 2 – point c a (new)

(ca) all the documents proving the fulfilment of the requirements set in this article have been received from the manufacturer and are available for inspection.

Amendment 343 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 13 – paragraph 3

3. Where an importer considers or has reason to believe that a product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I, the importer shall not place the product on the market until that product or the processes put in place by the manufacturer have been brought into conformity with the essential requirements set out in Annex I. Furthermore, where the product with digital elements presents a ~~significant~~ cybersecurity risk, the importer shall inform the manufacturer and the market surveillance authorities to that effect.

Amendment 344 #

Proposal for a regulation
Article 13 – paragraph 6 – subparagraph 1

Amendment 345 #

Proposal for a regulation
Article 13 – paragraph 6 – subparagraph 1

Importers who know or have reason to believe that a product with digital elements, which they have placed on the market, or the processes put in place by its manufacturer, are not in conformity with the essential requirements set out in Annex I or non-technical risk factors shall immediately take the corrective measures necessary to bring that product with digital elements or the processes put in place by its manufacturer into conformity with the essential requirements set out in Annex I, or to withdraw or recall the product, if appropriate.

Amendment 346 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 13 – paragraph 6 – subparagraph 1

Importers who know or have reason to believe that a product with digital elements, which they have placed on the market, or the processes put in place by its manufacturer, are not in conformity with the essential requirements set out in Annex I shall immediately require the manufacturer to take the corrective measures necessary to bring that product with digital elements or the processes put in place by its manufacturer into conformity with the essential requirements set out in Annex I, or to withdraw or recall the product, if appropriate.

Amendment 347 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 13 – paragraph 6 – subparagraph 2

Upon identifying a vulnerability in the product with digital elements, importers shall inform the manufacturer without undue delay about that vulnerability. Furthermore, where the product with digital elements presents a significant cybersecurity risk, importers shall immediately inform the market surveillance authorities of the Member States in which they made the product with digital elements available on the market to that effect, giving details, in particular, of the non-conformity and of any corrective measures taken.

Amendment 348 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 13 – paragraph 6 – subparagraph 2 a (new)

Upon receiving information from the manufacturer that the product with digital elements presents a significant cybersecurity risk, giving details, in particular, of the non-conformity and of any corrective measures taken, importers shall immediately forward this information to the market surveillance authorities of the Member States in which they made the product with digital elements available on the market to that effect.

Amendment 349 #

Proposal for a regulation
Article 14 – paragraph 2 – point b a (new)

(ba) Non-technical risk factors of the manufacturer are taken into consideration for critical products described in Class II of Annex III intended for the use by essential entities of the type referred to in [Annex I to the Directive XXX/XXXX (NIS2)];

Amendment 350 #

Proposal for a regulation
Article 14 – paragraph 2 – point b a (new)

(ba) they have received from the importer all the information and documentation required by this regulation.

Amendment 351 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 14 – paragraph 3

3. Where a distributor considers or has reason to believe that a product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I, the distributor shall not make the product with digital elements available on the market until that product or the processes put in place by the manufacturer have been brought into conformity. Furthermore, where the product with digital elements poses a ~~significant~~ cybersecurity risk, the distributor shall inform the manufacturer and the market surveillance authorities to that effect.

Amendment 352 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 14 – paragraph 4 – subparagraph 1

Distributors who know or have reason to believe that a product with digital elements, which they have made available on the market, or the processes put in place by its manufacturer are not in conformity with the essential requirements set out in Annex I shall ~~make sure that th~~require the manufacturer to take corrective measures necessary to bring that product with digital elements or the processes put in place by its manufacturer into conformity are taken, or to withdraw or recall the product, if appropriate.

Amendment 353 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 14 – paragraph 4 – subparagraph 2

Upon identifying a vulnerability in the product with digital elements, distributors shall inform the manufacturer without undue delay about that vulnerability. Furthermore, where the product with digital elements presents a significant cybersecurity risk, distributors shall immediately inform the market surveillance authorities of the Member States in which they have made the product with digital elements available on the market to that effect, giving details, in particular, of the non-conformity and of any corrective measures taken.

Amendment 354 #

Proposal for a regulation
Article 14 – paragraph 4 – subparagraph 2

Upon identifying a vulnerability in the product with digital elements, distributors shall inform the manufacturer without undue delay about that vulnerability. Furthermore, where the product with digital elements presents a significant cybersecurity risk including on the basis of non-technical risk factors, distributors shall immediately inform the market surveillance authorities of the Member States in which they have made the product with digital elements available on the market to that effect, giving details, in particular, of the non-conformity and of any corrective measures taken.

Amendment 355 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 14 – paragraph 4 – subparagraph 2 a (new)

Upon receiving information from the manufacturer that the product with digital elements presents a significant cybersecurity risk, giving details, in particular, of the non-conformity and of any corrective measures taken, distributors shall immediately forward this information to the market surveillance authorities of the Member States in which they made the product with digital elements available on the market to that effect.

Amendment 356 #

Proposal for a regulation
Article 16 – paragraph 1

Amendment 357 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 16 – paragraph 1

A natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of the product with digital elements and commercially supplies it in the market, shall be considered a manufacturer for the purposes of this Regulation.

Amendment 358 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 16 – paragraph 1

A natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of the product with digital elements, with the intention of making a profit, shall be considered a manufacturer for the purposes of this Regulation.

Amendment 359 #

Nicola DANTI

Proposal for a regulation
Article 16 – paragraph 1

A natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of the product with digital elements and makes it available on the market shall be considered a manufacturer for the purposes of this Regulation.

Amendment 360 #

Proposal for a regulation
Article 16 – paragraph 1

A natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of the product with digital elements, making it available on the market, shall be considered a manufacturer for the purposes of this Regulation.

Amendment 361 #

Proposal for a regulation
Article 17 – paragraph 1 – introductory part

1. Economic operators shall, on request ~~and where the information is available~~, provide to the market surveillance authorities the following information:

Amendment 362 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 17 a (new)

Article17a Specific obligations of providers of online marketplaces 1. Without prejudice to the general obligations provided for in Article 11 of Regulation (EU) 2022/2065, providers of online marketplaces shall designate a single point of contact allowing for direct communication, by electronic means, with Member States’ market surveillance authorities in relation to cybersecurity issues. 2. Without prejudice to the general obligations provided for in Article 12 of Regulation (EU) 2022/2065, providers of online marketplaces shall designate a single point of contact to enable consumers to communicate directly and rapidly with them in relation to cybersecurity issues. 3. As regards powers conferred by Member States in accordance with Article 14 of Regulation (EU) 2019/1020, Member States shall confer on their market surveillance authorities the necessary power, as regards specific content referring to an offer of a product with digital elements, which presents a significant cybersecurity risk or a vulnerability, to issue an order requiring the providers of online marketplaces to remove such content from their online interface, to disable access to it or to display an explicit warning. Such orders shall be issued in accordance with the minimum conditions set out in Article 9(2) of Regulation (EU) 2022/2065. Providers of online marketplaces shall take the necessary measures to receive and process orders issued pursuant to this paragraph and they shall act without undue delay. 4. Orders issued pursuant to paragraph 4 may require the provider of an online marketplace, for the prescribed period, to remove from its online interface all identical content referring to an offer of the product in question, to disable access to it or to display an explicit warning, provided that the search for the content concerned is limited to the information identified in the order and does not require the provider of an online marketplace to carry out an independent assessment of that content, and that the search and the removal can be carried out in a proportionate manner by reliable automated tools. 5. Providers of online marketplaces shall, without undue delay, process the notices related to cybersecurity issues with regard to the product offered for sale online through their services, received in accordance with Article 16 of Regulation (EU) 2022/2065. 6. For the purpose of compliance with the requirements of Article 31(1) and (2) of Regulation (EU) 2022/2065 as regards product safety information, providers of online marketplaces shall design and organise their online interface in a way that enables traders offering the product to provide at least the following information for each product offered and that ensures that the information is displayed or otherwise made easily accessible by consumers on the product listing: (a) name, registered trade name or registered trade mark of the manufacturer, as well as the postal and electronic address at which the manufacturer can be contacted; (b) information allowing the identification of the product, including a picture of it, its type and any other product identifier; and (c) any warning or safety information to be affixed on the product or to accompany it in accordance with this Regulation or the applicable Union harmonisation legislation in a language which can be easily understood by consumers as determined by the Member State in which the product is made available on the market. 7. For the purpose of compliance with Article 23 of Regulation (EU) 2022/2065 regarding cybersecurity issues, providers of online marketplaces shall suspend, for a reasonable period of time and after having issued a prior warning, the provision of their services to traders that frequently offer products which are non- compliant with this Regulation. 8. Providers of online marketplaces shall cooperate with the market surveillance authorities, with traders and with relevant economic operators to facilitate any action taken to eliminate or, if that is not possible, to mitigate the risks presented by a product that is or was offered online through their services.

Amendment 363 #

Proposal for a regulation
Article 18 – paragraph 1

1. Products with digital elements and processes put in place by the manufacturer which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the essential requirements covered by those standards or parts thereof, set out in Annex I. The Commission shall in accordance with Article 10(1) of Regulation (EU) 1025/2012 request one or more European standardisation organisations to draft harmonised standards for the essential requirements set out in Annex I. When preparing the Standardisation Request for this Regulation, the Commission shall aim for maximum harmonisation with existing or imminent international standards for cybersecurity.

Amendment 364 #

Proposal for a regulation
Article 18 – paragraph 1 a (new)

1a. Products with digital elements and processes put in place by the manufacturer which are in conformity with international standards or parts thereof shall be presumed to be in conformity with the essential requirements covered by those standards or parts thereof, set out in Annex I, where harmonised standards referred to in paragraph 1 of this Article do not exist or where there are undue delays in the standardisation procedure or where the request for harmonised standards by the Commission has not been accepted by the European standardisation organisations.

Amendment 365 #

Proposal for a regulation
Article 18 – paragraph 2

Amendment 366 #

Proposal for a regulation
Article 18 – paragraph 4

4. The Commission is empowered, by means of implementing acts, to specify the European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 t~~hat can~~o be used to demonstrate conformity of critical products with digital elements with the essential requirements or parts thereof as set out in Annex I. Furthermore, ~~where applicable, the Commission shall specify i~~the issuance of a cybersecurity certificate issued under such schemes, at substantial or high level, eliminates the obligation of a manufacturer to carry out a third-party conformity assessment for the corresponding requirements, as set out in Article 24(2)(a), (b), (3)(a) and (b). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 51(2).

Amendment 367 #

Proposal for a regulation
Article 19

Amendment 368 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Carlos ZORRINHO

Proposal for a regulation
Article 19 – paragraph 1

Amendment 369 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 19 – paragraph 1

Amendment 370 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 19 – paragraph 1

Amendment 371 #

Proposal for a regulation
Article 23 – paragraph 2

2. The technical documentation shall be drawn up before the product with digital elements is placed on the market and shall be continuously updated, where appropriate, during the expected product lifetime ~~or during a period of five years after the placing on the market of a product with digital elements, whichever is shorter~~.

Amendment 372 #

Proposal for a regulation
Article 23 – paragraph 2

Amendment 373 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 23 – paragraph 5

5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by the elements to be included in the technical documentation set out in Annex V to take account of technological developments, as well as developments encountered in the implementation process of this Regulation. When adopting delegated acts, the Commission shall take into account and make sure the administrative burden on micro, small and medium sized enterprises is kept to a minimum.

Amendment 374 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 23 – paragraph 5

5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by the elements to be included in the technical documentation set out in Annex V to take account of technological developments, of the dimension of economic operators with particular regard to micro, small and medium sized enterprises, as well as developments encountered in the implementation process of this Regulation.

Amendment 375 #

Proposal for a regulation
Article 24 – paragraph 1 – point c a (new)

(ca) a European cybersecurity certification scheme adopted as per Regulation (EU) 2019/881 in accordance with paragraph 4 of Article 18.

Amendment 376 #

Proposal for a regulation
Article 24 – paragraph 2 – introductory part

2. Where, in assessing the compliance of the critical product with digital elements of class I as set out in Annex III and the processes put in place by its manufacturer with the essential requirements set out in Annex I, the manufacturer or the manufacturer’s authorised representative has not applied or has applied only in part harmonised standards, common specifications or European cybersecurity certification schemes as referred to in Article 18, or where such harmonised standards, common specifications or European cybersecurity certification schemes or international standards do not exist, the product with digital elements concerned and the processes put in place by the manufacturer shall be submitted with regard to those essential requirements to either of the following procedures:

Amendment 377 #

Proposal for a regulation
Article 24 – paragraph 2 – point b a (new)

(ba) where applicable, a European cybersecurity certification scheme at assurance level ‘substantial’ or ‘high’ pursuant to Regulation (EU) 2019/881.

Amendment 378 #

Proposal for a regulation
Article 24 – paragraph 3 – introductory part

3. Where the product is a critical product with digital elements of class II as set out in Annex III, the manufacturer or the manufacturer’s authorised representative shall demonstrate conformity with the essential requirements set out in Annex I by acquiring a cybersecurity certificate issued by a European authority, under the European cybersecurity certification scheme and at assurance level "high" as listed in the Regulation (EU) 2019/881. For products with digital elements for which a European cybersecurity certification scheme does not exist or covers them only partially, the manufacturer or the manufacturer’s authorised representative shall demonstrate conformity with the essential requirements set out in Annex I by using one of the following procedures:

Amendment 379 #

Proposal for a regulation
Article 24 – paragraph 3 – introductory part

3. Where the product is a critical product with digital elements of class II as set out in Annex III, the manufacturer or the manufacturer’s authorised representative shall demonstrate conformity with the essential requirements set out in Annex I obtaining a European cybersecurity certificate, under a European cybersecurity certification scheme at assurance level ‘high’ pursuant to Regulation (EU) 2019/881. Where such European cybersecurity certification schemes do not exist or only cover parts of the critical product with digital elements, the concerned critical product and the processes put in place by the manufacturer shall demonstrate those essential requirements by using one of the following procedures:

Amendment 380 #

Proposal for a regulation
Article 24 – paragraph 3 – point b a (new)

(ba) ENISA shall prepare the missing candidate schemes in order to cover all products listed in Annex III, in accordance with Article 48 of the (EU) 2019/881 Regulation.

Amendment 381 #

Proposal for a regulation
Article 24 – paragraph 3 a (new)

3a. In accordance with Article 48 of Regulation (EU) 2019/881, the Commission shall request ENISA to prepare the missing candidate schemes with the view of fully covering all the products listed in Annex III.

Amendment 382 #

Proposal for a regulation
Article 24 – paragraph 5

Amendment 383 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 24 – paragraph 5

5. Notified bodies shall take into account the specific interests and needs of micro, small and medium sized enterprises (SMEs) when setting the fees for conformity assessment procedures and reduce those fees proportionately to their specific interests and needs. The Commission shall ensure that appropriate financial support in the regulatory framework of existing Union programmes is allocated to micro, small and medium- sized enterprises, in order to mitigate possible financial burden.

Amendment 384 #

Proposal for a regulation
Article 24 – paragraph 5

5. Notified bodies shall take into account the specific interests and needs of ~~small and medium sized enterprises (~~SMEs) when setting the fees for conformity assessment procedures and reduce those fees proportionately to their specific interests and needs.

Amendment 385 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 24 – paragraph 5

5. Notified bodies shall take into account the specific interests and needs of micro, small and medium sized enterprises ~~(SMEs)~~ when setting the fees for conformity assessment procedures and reduce those fees proportionately to their specific interests and needs.

Amendment 386 #

Proposal for a regulation
Article 25 – paragraph 1

Amendment 387 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 28 – paragraph 1 a (new)

1a. The Commission shall, within 24 months from the entry into force of this Regulation, ensure that there is a sufficient number of notified bodies in the Union to carry out a conformity assessment, in order to avoid bottlenecks and hindrances to market entry.

Amendment 388 #

Proposal for a regulation
Article 29 – paragraph 7 – point c

(c) appropriate knowledge and understanding of the essential requirements set out in Annex I, of the applicable harmonised standards and of the relevant provisions of Union harmonisation legislation and of its implementing acts;

Amendment 389 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 29 – paragraph 7 a (new)

7a. Member States shall put in place appropriate measures to ensure sufficient availability of skilled professionals, in order to minimise bottlenecks in the assessment activities and facilitate the compliance of economic operators to this Regulation.

Amendment 390 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 29 – paragraph 12

12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, in particular taking into account the interests of ~~SME~~micro, small and medium sized enterprises in relation to fees.

Amendment 391 #

Proposal for a regulation
Article 29 – paragraph 12

12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, in particular taking into account the interests of ~~SME~~micro, small and medium enterprises in relation to fees.

Amendment 392 #

Proposal for a regulation
Article 29 – paragraph 12

Amendment 393 #

Proposal for a regulation
Article 37 – paragraph 2

Amendment 394 #

Proposal for a regulation
Article 37 – paragraph 4

4. Where a notified body finds that requirements laid down in Annex I or in corresponding harmonised standards or in international standards or in common specifications as referred to in Article 19 have not been met by a manufacturer, it shall require that manufacturer to take appropriate corrective measures and shall not issue a conformity certificate.

Amendment 395 #

Amendment 396 #

Proposal for a regulation
Article 41 – paragraph 3

3. Where relevant, the market surveillance authorities shall cooperate with the national cybersecurity certification authorities designated under Article 58 of Regulation (EU) 2019/881, competent authorities and CSIRTs designated under Articles 8 and 10 of Directive (EU) 2022/2555 and exchange information on a regular basis. With respect to the supervision of the implementation of the reporting obligations pursuant to Articles 10a and 11 of this Regulation, the designated market surveillance authorities shall cooperate with CSIRTs and ENISA.

Amendment 397 #

Proposal for a regulation
Article 41 – paragraph 3 a (new)

3a. With respect to the supervision of the implementation of the reporting obligations pursuant to Article 11 of this Regulation, the designated market surveillance authorities shall cooperate with ENISA. The market surveillance authorities may request ENISA to provide technical advice on matters related to the implementation and enforcement of this Regulation. When conducting an investigation under Article 43, market surveillance authorities may request ENISA to provide non-binding evaluations of compliance of products with digital elements.

Amendment 398 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 41 – paragraph 6

6. Member States shall ensure that the designated market surveillance authorities are provided with adequate financial and human resources, with appropriate cybersecurity skills, in order to fulfil their tasks under this Regulation.

Amendment 399 #

Proposal for a regulation
Article 41 – paragraph 8

8. Market surveillance authorities may provide guidance and advice to economic operators on the implementation of this Regulation, including on non-technical risk factors, with the support of the Commission.

Amendment 400 #

Proposal for a regulation
Article 41 – paragraph 8

8. Market surveillance authorities may provide guidance and advice to economic operators on the implementation of this Regulation, with the support of CSIRTS, ENISA and the Commission.

Amendment 401 #

Proposal for a regulation
Article 41 – paragraph 8 a (new)

8a. Market surveillance authorities may publish statistics about the average expected product lifetime, as specified by the manufacturer pursuant to article 10 (10a), per category of products with digital elements.

Amendment 402 #

Proposal for a regulation
Article 41 – paragraph 9 a (new)

9a. The Commission shall evaluate the reported data, including the for the purpose of report referred to in Article 41(9). Where the reported data suggest an increased level of non-compliance in specific categories of products, the Commission, after consulting the Expert Group and ADCO, may recommend that all surveillance authorities focus closely on the product categories concerned.

Amendment 403 #

Proposal for a regulation
Article 41 – paragraph 11

11. A dedicated administrative cooperation group (ADCO) for cyber resilience of products with digital elements shall be established for the uniform application of this Regulation, pursuant to Article 30(2) of Regulation (EU) 2019/1020. This ADCO shall be composed of representatives of the designated market surveillance authorities and, if appropriate, representatives of single liaison offices. In particular, this ADCO shall exchange best practices and, where relevant, cooperate with Cyber Resilience Expert Group, ENISA, Cooperation Group and CSITs Network.

Amendment 404 #

Proposal for a regulation
Article 41 – paragraph 11 a (new)

11a. Market surveillance authorities shall facilitate the active participation of stakeholders in market surveillance activities, including scientific, research and consumer organisations, by establishing a clear and accessible mechanism to facilitate the voluntary reporting of vulnerabilities, incidents, and cyber threats.

Amendment 405 #

Proposal for a regulation
Article 41 a (new)

Article41a Expert group on technical matters 1. The Commission shall establish an expert group in order to provide technical advice to the Commission and competent authorities on matters related to in the implementation and enforcement of this Regulation. In particular, the expert group shall provide non-binding evaluations of products with digital elements upon request by a market surveillance authority that is conducting an investigation under Article 43 and guidance on the application of relevant concepts of the New-Legislative Framework to software, in particular free and open source software. 2. The expert group shall consist of independent experts appointed for a renewable three-year term by the Commission on the basis of their scientific or technical expertise in the field. The Commission shall appoint a number of experts which is deemed sufficient to fulfil the foreseen needs, ensuring that their professional background and affiliations result in a balanced representation of stakeholder interests, in particular open source organisations, national accreditation bodies, conformity assessment bodies pursuant to Regulation (EC) No 765/2008 of the European Parliament and of the Council, data protection authorities, as well as academia and consumer organisations. 3. The Commission shall take the necessary measures to manage and prevent any conflicts of interest. The Declarations of interests of the members of the expert group shall be made publicly available. 4. The appointed experts shall perform their tasks with the highest level of professionalism, independence, impartiality and objectivity. 5. When adopting positions, views and reports, the expert group shall attempt to reach consensus. If consensus cannot be reached, decisions shall be taken by a qualified majority of the group members.

Amendment 406 #

Proposal for a regulation
Article 41 a (new)

Article41a Civil society participation in market surveillance activities The active participation of the relevant actors of the civil society (consumers’ organizations, the scientific community, trade unions, etc.) in market surveillance activities, shall be ensured by market surveillance authorities in the Member States and at EU level, in order to create mechanisms to facilitate the voluntary reporting of vulnerabilities, incidents, and cyber threats.

Amendment 407 #

Where the market surveillance authority of a Member State has sufficient reasons to consider that a product with digital elements, including its vulnerability handling, presents a significant cybersecurity or strategic risk, it shall carry out an evaluation of the product with digital elements concerned in respect of its compliance with all the requirements laid down in this Regulation, including non- technical risk factors. The relevant economic operators shall cooperate as necessary with the market surveillance authority.

Amendment 408 #

Proposal for a regulation
Article 43 – paragraph 1 – subparagraph 1

Where the market surveillance authority of a Member State has sufficient reasons to consider that a product with digital elements, including its vulnerability handling, presents a significant cybersecurity risk, it shall carry out, where appropriate in cooperation with CSIRT, an evaluation of the product with digital elements concerned in respect of its compliance with all the requirements laid down in this Regulation. The relevant economic operators shall cooperate as necessary with the market surveillance authority.

Amendment 409 #

Proposal for a regulation
Article 43 – paragraph 1 – subparagraph 1

Where the market surveillance authority of a Member State has sufficient reasons to consider that a product with digital elements, including its vulnerability handling, presents a significant cybersecurity risk, it shall carry out without undue delay an evaluation of the product with digital elements concerned in respect of its compliance with all the requirements laid down in this Regulation. The relevant economic operators shall cooperate as necessary with the market surveillance authority.

Amendment 410 #

Proposal for a regulation
Article 43 – paragraph 1 – subparagraph 2

Where, in the course of that evaluation, the market surveillance authority finds that the product with digital elements does not comply with the requirements laid down in this Regulation, it shall without delay, and within a maximum of five working days, require the relevant economic operator to take all appropriate corrective actions to bring the product into compliance with those requirements, to withdraw it from the market, or to recall it within a reasonable period, commensurate with the nature of the risk, as it may prescribe.

Amendment 411 #

Proposal for a regulation
Article 43 – paragraph 1 – subparagraph 2

Where, in the course of that evaluation, the market surveillance authority finds that the product with digital elements does not comply with the requirements laid down in this Regulation or present threat to national security, it shall without delay require the relevant operator to take all appropriate corrective actions to bring the product into compliance with those requirements, to withdraw it from the market, or to recall it within a reasonable period, commensurate with the nature of the risk, as it may prescribe.

Amendment 412 #

Proposal for a regulation
Article 43 – paragraph 1 – subparagraph 2

Where, in the course of that evaluation, the market surveillance authority finds that the product with digital elements does not comply with the requirements laid down in this Regulation, it shall without delay require the relevant economic operator to take all appropriate corrective actions to bring the product into compliance with those requirements, to withdraw it from the market, or to recall it within a ~~reasonabl~~n adequate period, commensurate with the nature of the risk~~, as it may prescribe~~.

Amendment 413 #

Proposal for a regulation
Article 43 – paragraph 4 – subparagraph 1

Where the manufacturer of a product with digital elements does not take adequate corrective action within the period referred to in paragraph 1, second subparagraph, or where the relevant Member State authority consider product to present threat to national security, the market surveillance authority shall take all appropriate provisional measures to prohibit or restrict that product being made available on its national market, to withdraw it from that market or to recall it.

Amendment 414 #

Proposal for a regulation
Article 43 – paragraph 5 – point b

(b) shortcomings in the harmonised standards, cybersecurity certification schemes, or international standards common specifications, referred to in Article 18.

Amendment 415 #

Proposal for a regulation
Article 43 – paragraph 7

7. Where, within three months of receipt of the information referred to in paragraph 4, no objection has been raised by either a Member State or the Commission in respect of a provisional measure taken by a Member State, that measure shall be deemed justified. The decision referred to in paragraph 1 of this Article, concerning threat to national security, shall always be deemed justified. This is without prejudice to the procedural rights of the operator concerned in accordance with Article 18 of Regulation (EU) 2019/1020.

Amendment 416 #

Proposal for a regulation
Article 44 – paragraph 5

5. Where the national measure is considered justified and the non- compliance of the product with digital elements is attributed to shortcomings in common specifications as referred to in Article 19, the Commission shall consider whether to amend or repeal the implementing act referred to in Article 19 setting out those common specifications.deleted

Amendment 417 #

Proposal for a regulation
Article 45 – paragraph 1

1. Where the Commission has sufficient reasons to consider, including based on information provided by the competent authorities of Member States, CSIRTs designated in accordance with Directive (EU) 2022/2555 or ENISA, that a product with digital elements that presents a significant cybersecurity risk is non-compliant with the requirements laid down in this Regulation, it may request the relevant market surveillance authorities to carry out an evaluation of compliance and follow the procedures referred to in Article 43.

Amendment 418 #

Proposal for a regulation
Article 45 – paragraph 1

1. Where the Commission has sufficient reasons to consider, including based on information provided by ENISA or non-technical risk factors, that a product with digital elements that presents a significant cybersecurity risk is non- compliant with the requirements laid down in this Regulation, it may request the relevant market surveillance authorities to carry out an evaluation of compliance and follow the procedures referred to in Article 43.

Amendment 419 #

Proposal for a regulation
Article 45 – paragraph 1

Amendment 420 #

Proposal for a regulation
Article 45 – paragraph 2

2. In exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market and where the Commission has sufficient reasons to consider that the product referred to in paragraph 1 remains non-compliant with the requirements laid down in this Regulation, including on the basis of non-technical risk factors, and no effective measures have been taken by the relevant market surveillance authorities, the Commission may request ENISA to carry out an evaluation of compliance. The Commission shall inform the relevant market surveillance authorities accordingly. The relevant economic operators shall cooperate as necessary with ENISA.

Amendment 421 #

Proposal for a regulation
Article 45 – paragraph 2

2. In exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market and where the Commission has sufficient reasons, substantiated by relevant data, to consider that the product referred to in paragraph 1 remains non- compliant with the requirements laid down in this Regulation and no effective measures have been taken by the relevant market surveillance authorities, the Commission may request the relevant Member State authority ENISA to carry out an evaluation of compliance. The Commission shall inform the relevant market surveillance authorities and ENISA accordingly. ~~The relevant economic operators shall cooperate as necessary with ENISA.~~

Amendment 422 #

Proposal for a regulation
Article 45 – paragraph 2

Amendment 423 #

Proposal for a regulation
Article 45 – paragraph 3

3. Based on ~~ENISA’s evalu~~Member State’s authority evaluation and recommendation, the Commission may decide that a corrective or restrictive measure is necessary at Union level. To this end, it shall without delay consult the Member States concerned and the relevant economic operator or operators.

Amendment 424 #

Proposal for a regulation
Article 46 – paragraph 1

Amendment 425 #

Proposal for a regulation
Article 46 – paragraph 2

Amendment 426 #

Proposal for a regulation
Article 46 – paragraph 6

Amendment 427 #

Proposal for a regulation
Article 46 – paragraph 7

Amendment 428 #

Proposal for a regulation
Article 46 – paragraph 8

Amendment 429 #

Proposal for a regulation
Article 48 – paragraph 2

Amendment 430 #

Proposal for a regulation
Article 49 – paragraph 1

Amendment 431 #

Proposal for a regulation
Article 49 – paragraph 2

Amendment 432 #

Proposal for a regulation
Article 49 – paragraph 3

Amendment 433 #

Proposal for a regulation
Article 49 – paragraph 4

4. When conducting sweeps, the market surveillance authorities involved ~~may~~shall use the investigation powers set out Articles 41 to 47 and any other powers conferred upon them by national law.

Amendment 434 #

Proposal for a regulation
Article 49 – paragraph 5

5. Market surveillance authorities ~~may~~shall invite Commission officials, and other accompanying persons authorised by the Commission, to participate in sweeps.

Amendment 435 #

Proposal for a regulation
Article 49 a (new)

Article49a Cyber Resilience Regulatory Sandboxes The Commission, ENISA and Member States shall establish a European cyber resilience regulatory sandboxes with voluntary participation of manufacturers of products with digital elements to: (a) provide for a controlled environment that facilitates the development, testing and validation of the design, development and production of products with digital elements, before their placement on the market or putting into service pursuant to a specific plan; (b) provide practical support to economic operators, in the first place to SME’s, with particular attention paid to micro enterprises and start-ups, including via guidelines and best practices to comply with the essential requirements set out in Annex I; (c) contribute to evidence-based regulatory learning.

Amendment 436 #

Proposal for a regulation
Article 49 a (new)

Article49a Right to compensation for damage or loss Consumers suffering damage or loss caused by infringements of the obligations under this Regulation by the relevant economic operators, have the right to seek compensation, in accordance with Union and national law.

Amendment 437 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 50 – paragraph 2

2. The power to adopt delegated acts referred to in Article 2(4), Article 6(2), Article 6(3), Article 6(5), Article 10 (15), Article 11(5), Article 19 (1), Article 20(5), and Article 23(5) shall be conferred on the Commission.

Amendment 438 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 50 – paragraph 3

3. The delegation of power referred to in Article 2(4), Article 6(2), Article 6(3), Article 6(5), Article 10(15), Article 11 (5), Article 19(1), Article 20(5), and Article 23(5) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

Amendment 439 #

Proposal for a regulation
Article 50 – paragraph 4

4. Before adopting a delegated act, the Commission shall launch a public consultation and consult experts designated by each Member State in accordance with principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making.

Amendment 440 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 50 – paragraph 6 a (new)

6a. When exercising the power of delegation, the Commission shall conduct public consultations and engage in regular dialogue with economic operators, in order to collect evidence and evaluate market implications of including or withdrawing categories of products in the scope of this Regulation.

Amendment 441 #

Proposal for a regulation
Article 50 – paragraph 6 a (new)

6a. The Commission shall conduct thorough public consultations and engage in regular and structured dialogue with economic operators to gather evidence and evaluate market implications of including or withdrawing categories of products in scope.

Amendment 442 #

Proposal for a regulation
Article 51 – paragraph 3 a (new)

3a. The Committee shall conduct thorough public consultations and engage in regular and structured dialogue with economic operators to gather evidence and evaluate market implications of including or withdrawing categories of products in scope.

Amendment 443 #

Zdzisław KRASNODĘBSKI, Adam BIELAN, Kosma ZŁOTOWSKI

Proposal for a regulation
Article 52 – paragraph 1 – point a

(a) intellectual property rights~~, and confidential business information or trade secrets of a natural or legal person, including source code, except the cases referred to in Article 5 of~~ or trade secrets in line with Directive 2016/943 of the European Parliament and of the Council36; _________________ 36 Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1).

Amendment 444 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 53 – paragraph 1

1. Member States shall lay down the rules on penalties applicable to infringements by economic operators of this Regulation and shall take all measures necessary to ensure that they are enforced. The penalties provided for shall be effective, proportionate and dissuasive. These rules shall take into account the financial capabilities of micro, small and medium-sized enterprises.

Amendment 445 #

Proposal for a regulation
Article 53 – paragraph 6 – point a a (new)

(aa) the type of manufactured product and whether entity qualifies as microenterprise for the specific compliance regime outlined in the Article 10(-1) of this Regulation.

Amendment 446 #

Proposal for a regulation
Article 53 – paragraph 6 – point b a (new)

(ba) whether the manufacturer is SME, with particular attention payed to micro enterprises and start-ups, and whether adequate advice and/or financial support has been provided to them to ensure their compliance with this Regulation;

Amendment 447 #

Proposal for a regulation
Article 53 – paragraph 6 – point c

(c) the size and market share of the operator committing the infringement, taking into account the scale of risks, consequences and financial specificities of micro, small and medium-sized enterprises.

Amendment 448 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Article 53 a (new)

Article53a Allocation of penalties Member States shall determine the use of revenues generated from the payments of penalties. At least 50% of the revenues generated from the payments of penalties referred to in Article 53 (1) should be earmarked for one or more of the following: (i) increasing the number of skilled professionals in the field of cybersecurity, notably of women; (ii) capacity-building for micro, small and medium sized enterprises in order to facilitate their compliance with this Regulation; (iii) improving public awareness of cyber threats, with particular regard to their prevention and management;

Amendment 449 #

Proposal for a regulation
Article 55 – paragraph 2 a (new)

2a. Products with digital elements included in Annex III when placed on the market may meet the conformity assessment requirements under Chapter III by applying the procedure of Article 24 paragraph 1 for a period of 24 months after the date of application of this Regulation as defined in Article 57.

Amendment 450 #

Proposal for a regulation
Article 55 – paragraph 3

3. By way of derogation from paragraph 2, the obligations laid down in Article 11 shall apply to all products with digital elements within the scope of this Regulation that have been placed on the market ~~befor~~24 months after the [date of ~~application~~entry into force of this Regulation ~~referred to in Article 57]~~.

Amendment 451 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 55 – paragraph 3 a (new)

3a. 4 (new) By way of derogation, for products with digital elements falling in scope of Regulation (Machinery Regulation proposal) or Regulation (EU) 167/2013 of the European Parliament and of the Council, the application date referred to art. 57 is extended by (36 months).

Amendment 452 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 55 – paragraph 3 b (new)

3b. By way of derogation for products with digital elements falling in scope of Regulation (Machinery Regulation proposal) or Regulation 2013/167, where the annual new sales in the EU of each type are fewer than (1000) units, the application date referred to art. 57 is extended by (60 months).

Amendment 453 #

Proposal for a regulation
Article 57 – paragraph 2

It shall apply from ~~[24 months after the date of entry into force of this Regulation]. However Article 11 shall apply from~~ [12 months after the date of entry into force of this Regulation].

Amendment 454 #

Proposal for a regulation
Article 57 – paragraph 2

It shall apply from [~~24 months after the date of entry into force of this Regulation]. However Article 11 shall apply from [12~~36 months after the date of entry into force of this Regulation].

Amendment 455 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA

Proposal for a regulation
Article 57 – paragraph 2

It shall apply from [2460 months after the date of entry into force of this Regulation]. However, Articles 10a and 11 shall apply from [124 months after the date of entry into force of this Regulation].

Amendment 456 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Article 57 – paragraph 2

It shall apply from [248 months after the date of entry into force of this Regulation]. However Article 11 shall apply from [124 months after the date of entry into force of this Regulation].

Amendment 457 #

Proposal for a regulation
Article 57 – paragraph 2

It shall apply from [2430 months after the date of entry into force of this Regulation]. However Article 11 shall apply from [12 months after the date of entry into force of this Regulation].

Amendment 458 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Adam JARUBAS

Proposal for a regulation
Article 57 – paragraph 2

It shall apply from [324 months after the date of entry into force of this Regulation]. However Article 11 shall apply from [122 months after the date of entry into force of this Regulation].

Amendment 459 #

Proposal for a regulation
Article 57 – paragraph 2

It shall apply from [248 months after the date of entry into force of this Regulation]. However Article 11 shall apply from [124 months after the date of entry into force of this Regulation].

Amendment 460 #

Patrizia TOIA

Proposal for a regulation
Article 57 – paragraph 2 a (new)

By way of derogation, for products with digital elements falling in scope of Regulation [Machinery Regulation] or Regulation 2013/167, the application date referred to in paragraph 2 is extended by [36 months] or, if annual new sales of each product model in the EU are fewer than 1000 units by [60 months]

Amendment 461 #

Proposal for a regulation
Annex I – Part 1 – point 2

~~(2) Products with digital elements shall be delivered without any known exploitable vulnerabilities;~~deleted

Amendment 462 #

Proposal for a regulation
Annex I – Part 1 – point 2

~~(2) Products with digital elements shall be delivered without any known exploitable vulnerabilities;~~deleted

Amendment 463 #

Henna VIRKKUNEN, Sara SKYTTEDAL, Ivan ŠTEFANEC, Tomas TOBÉ, Angelika NIEBLER

Proposal for a regulation
Annex I – Part 1 – point 2

(2) Products with digital elements shall be delivered without any known exploitable vulnerabilities which the manufacturer knows of, unless a manufacturer ensures that there are updates available which remedy this vulnerability and these are run automatically at the first time of use of the product;

Amendment 464 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Annex I – Part 1 – point 3 – introductory part

(3) On the basis of the cybersecurity risk assessment referred to in Article 10(2) and where applicable, products with digital elements shall:

Amendment 465 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point a

(a) ~~be delivered~~consumer products with digital elements shall be placed on the market with a secure by default configuration, including the possibility to reset the product to its ~~original state;~~ default security configuration; where the above described configuration is not possible in case of business-to-business products with digital elements, they may be configured on the basis of individual contractual arrangements;

Amendment 466 #

Beatrice COVASSI, Robert HAJŠEL, Patrizia TOIA, Lina GÁLVEZ, Carlos ZORRINHO

Proposal for a regulation
Annex I – Part 1 – point 3 – point a

(a) be delivered with a secure by default configuration, including the possibility to reset the product to its original state, while safeguarding its security;

Amendment 467 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point a a (new)

(aa) be placed on the market with functional separation of security updates from functionality updates, to allow automatic installation of security updates, with a clear and easy-to-use opt-out mechanism, and preserve user choice on functionalities unless technically unfeasible.

Amendment 468 #

(aa) (-a) be placed on the market without any known exploitable vulnerabilities described in the European vulnerability database referred to in Article 12(2) of Directive 2022/2555;

Amendment 469 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Annex I – Part 1 – point 3 – point a a (new)

(aa) be placed on the market without any known exploitable vulnerabilities towards an external device or network.

Amendment 470 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point b

(b) ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems; , but also by taking into consideration non-technical risk factors, such as third-country legislation that is applicable in the headquarter of the manufacturer obliging arbitrary government access to any kind of company data without legislative or democratic checks and balances or meaningful oversight mechanisms;

Amendment 471 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point c

Amendment 472 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point d

Amendment 473 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point f

(f) protect the availability of essential functions, ~~including~~also after an incident, including with backup management, and the resilience ~~against~~ and mitigation ofmeasures against denial of service attacks;

Amendment 474 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point f

(f) protect the availability of essential and basic functions, including the resilience against and mitigation of denial of service attacks;

Amendment 475 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point j

Amendment 476 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point k

(k) ~~ensure that~~ vulnerabilities in consumer products with digital elements can be addressed through security updates, including, where applicable, through automatic updates ~~and the notification of available updates to user~~by default, with optional opt-out, and, where applicable, through the notification of available updates to users with optional postponement; where the above described is not possible in case of business-to- business products with digital elements, the mechanism of handling of vulnerabilities may be set in the individual contractual arrangements.

Amendment 477 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point k

Amendment 478 #

Proposal for a regulation
Annex I – Part 1 – point 3 – point k a (new)

(ka) be designed, developed and produced in order to allow for its secure discontinuation and potential recycling when reaching the end of the life cycle, including by allowing users to securely withdraw and remove all data on a permanent basis.

Amendment 479 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – introductory part

MUnless already covered by relevant EU and sectoral legislations that apply, manufacturers of the products with digital elements shall:

Amendment 480 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 1

(1) identify and document vulnerabilities and components contained in the product, ~~including~~possibly by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product;

Amendment 481 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 1

(1) identify and document ~~vulnerabilities and~~ components contained in the product, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top- level dependencies of the product;

Amendment 482 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 2

(2) in relation to the risks posed to the products with digital elements, address and remediate vulnerabilities without delay, including by providing security updates; where the above described is not possible in case of business-to-business products with digital elements, the procedure for handling of vulnerabilities may be set in the individual contractual arrangements;

Amendment 483 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 2

(2) in relation to the risks posed to the products with digital elements, address and remediate vulnerabilities with~~out delay~~in an agreed timeline, including by providing security updates;

Amendment 484 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 4

(4) once a security update has been made available, share and publically disclose information about fixed vulnerabilities, in~~cluding a description of the vulnerabilities,~~ accordance with a coordinated vulnerability disclosure process, including information allowing users to identify the product with digital elements affected, the impacts of the vulnerabilities, their severity and information helping users to remediate the vulnerabilities. Detailed information about the vulnerabilities should only be shared and disclosed in a controlled way through coordinated disclosure procedures;

Amendment 485 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 4

Amendment 486 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 7

(7) provide for mechanisms to securely distribute security updates for products with digital elements to ensure that exploitable vulnerabilities are fixed or mitigated in a timely manner;

Amendment 487 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 8

(8) ensure that, where security patches or updates are available to address identified security issues, they are disseminated without delay and for consumer products with digital elements free of charge, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken; in case of business-to- business products with digital elements the procedures for patching and updating may be set in the individual contractual arrangements.

Amendment 488 #

Proposal for a regulation
Annex I – Part 2 – paragraph 1 – point 8

(8) ensure that, where security patches or updates are available to address identified security issues, they are disseminated without delay and, unless otherwise agreed between the parties, free of charge, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken.

Amendment 489 #

Proposal for a regulation
Annex II – paragraph 1 – point 1

1. the name, registered trade name or registered trade mark of the manufacturer, ~~and~~ the postal address ~~and~~, the email address and website at which the manufacturer can be contacted, on the product or, where that is not possible, on its packaging or in a document accompanying the product;

Amendment 490 #

Proposal for a regulation
Annex II – paragraph 1 – point 2

2. the single point of contact where information about cybersecurity vulnerabilities of the product can be reported and received;

Amendment 491 #

Proposal for a regulation
Annex II – paragraph 1 – point 5

5. any known or foreseeable circumstance, related to the use of the product with digital elements in accordance with its intended purpose or under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks;deleted

Amendment 492 #

Proposal for a regulation
Annex II – paragraph 1 – point 6

~~6. if and, where applicable, where the software bill of materials can be access~~deleted;

Amendment 493 #

Proposal for a regulation
Annex II – paragraph 1 – point 6

6. if and, where applicable, where the software bill of materials can be accessed; but are not to be made publicly accessible. If the software bill of materials are made available to notified bodies and market surveillance authorities for the exercise of their tasks, it must happen under the strict non-disclosure conditions set out in Article 52.

Amendment 494 #

Proposal for a regulation
Annex II – paragraph 1 – point 6

6. if and, where applicable, where the software bill of materials can be accessed by the competent authorities;

Amendment 495 #

Francesca DONATO

8. the type of technical security support ~~offer~~guaranteed by the manufacturer and until when it will be provided, at the very least until when users can expect to receive security updates;

Amendment 496 #

Proposal for a regulation
Annex II – paragraph 1 – point 9 – point c a (new)

(ca) the expected product lifetime and until when the manufacturer ensures the effective handling of vulnerabilities and provision of security updates.

Amendment 497 #

Proposal for a regulation
Annex III – Part I – point 3

3. ~~Password manager~~Authentication tools;

Amendment 498 #

Proposal for a regulation
Annex III – Part I – point 3 a (new)

3a. Authentication, Authorization and Accounting (AAA) platforms.

Amendment 499 #

Proposal for a regulation
Annex III – Part I – point 13

13. Remote access~~/sharing~~ software;

Amendment 500 #

Proposal for a regulation
Annex III – Part I – point 15

15. Physical and virtual network interfaces;

Amendment 501 #

Proposal for a regulation
Annex III – Part I – point 15

15. Physical and virtual network interfaces;

Amendment 502 #

Proposal for a regulation
Annex III – Part I – point 16

16. Operating systems ~~not covered by class II~~for servers, desktops and mobile devices;

Amendment 503 #

Proposal for a regulation
Annex III – Part I – point 16

16. Operating systems ~~not covered by class II~~;

Amendment 504 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Annex III – Part I – point 17

17. Firewalls, Security Gateways, intrusion detection and/or prevention systems not covered by class II;

Amendment 505 #

Proposal for a regulation
Annex III – Part I – point 17

17. Firewalls, intrusion detection and/or prevention systems ~~not covered by class II~~;

Amendment 506 #

Proposal for a regulation
Annex III – Part I – point 18

~~18. Routers, modems intended for the connection to the internet, and switches, not covered by class II;~~deleted

Amendment 507 #

Proposal for a regulation
Annex III – Part I – point 18

~~18. Routers, modems intended for the connection to the internet, and switches, not covered by class II;~~deleted

Amendment 508 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Annex III – Part I – point 18

18. Routers, modems intended for the connection to the internet, ~~and~~ switches, and other network nodes that are necessary for the provision of the connectivity service, not covered by class II;

Amendment 509 #

Proposal for a regulation
Annex III – Part I – point 18

18. Routers, modems intended for the connection to the internet, and switches~~, not covered by class II~~;

Amendment 510 #

Proposal for a regulation
Annex III – Part I – point 19

~~19. Microprocessors not covered by class II;~~deleted

Amendment 511 #

Proposal for a regulation
Annex III – Part I – point 19

19. Microprocessors ~~not covered by class II~~;

Amendment 512 #

Proposal for a regulation
Annex III – Part I – point 20

~~20. Microcontrollers;~~deleted

Amendment 513 #

Proposal for a regulation
Annex III – Part I – point 22

22. Industrial Automation & Control Systems (IACS) ~~not covered by class II~~, such as programmable logic controllers (PLC), distributed control systems (DCS), computerised numeric controllers for machine tools (CNC) and supervisory control and data acquisition systems (SCADA);

Amendment 514 #

Proposal for a regulation
Annex III – Part I – point 23

23. Industrial products with digital elements that can be referred as part of Internet of Things not covered by class II.

Amendment 515 #

Proposal for a regulation
Annex III – Part I – point 23

23. Industrial Internet of Things ~~not covered by class II~~.

Amendment 516 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Annex III – Part I – point 23 a (new)

23a. Authentication, Authorisation and Accounting (AAA) platforms.

Amendment 517 #

Proposal for a regulation
Annex III – Part I – point 23 a (new)

23a. Operating systems for servers, desktops, and mobile devices;

Amendment 518 #

Proposal for a regulation
Annex III – Part I – point 23 b (new)

23b. Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments;

Amendment 519 #

Proposal for a regulation
Annex III – Part I – point 23 c (new)

23c. Public key infrastructure and digital certificate issuers;

Amendment 520 #

Proposal for a regulation
Annex III – Part I – point 23 d (new)

23d. Secure elements;

Amendment 521 #

Proposal for a regulation
Annex III – Part I – point 23 e (new)

23e. Hardware Security Modules (HSMs);

Amendment 522 #

Proposal for a regulation
Annex III – Part I – point 23 f (new)

23f. Secure crypto processors;

Amendment 523 #

Proposal for a regulation
Annex III – Part I – point 23 g (new)

23g. Smartcards, smartcard readers and tokens;

Amendment 524 #

Proposal for a regulation
Annex III – Part I – point 23 h (new)

23h. Industrial Internet of Things devices intended for the use by essential entities of the type referred to in [Annex I to the Directive XXX/XXXX (NIS2)];

Amendment 525 #

Proposal for a regulation
Annex III – Part I – point 23 i (new)

23i. Robot sensing and actuator components and robot controllers;

Amendment 526 #

Proposal for a regulation
Annex III – Part I – point 23 j (new)

23j. Smart meters;

Amendment 527 #

Proposal for a regulation
Annex III – Part I – point 23 k (new)

23k. 26. Smart home products, including smart home servers and virtual assistants;

Amendment 528 #

Proposal for a regulation
Annex III – Part I – point 23 l (new)

23l. Smart security devices, including smart door locks, cameras and alarm systems;

Amendment 529 #

Proposal for a regulation
Annex III – Part I – point 23 m (new)

23m. Smart toys and similar devices likely to interact with children;

Amendment 530 #

Proposal for a regulation
Annex III – Part I – point 23 n (new)

23n. Personal health appliances and wearables.

Amendment 531 #

Proposal for a regulation
Annex III – Part II

II 1. Operating systems for servers, desktops, and mobile devices; 2. Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments; 3. Public key infrastructure and digital certificate issuers; 4. Firewalls, intrusion detection and/or prevention systems intended for industrial use; 5. General purpose microprocessors; 6. Microprocessors intended for integration in programmable logic controllers and secure elements; 7. Routers, modems intended for the connection to the internet, and switches, intended for industrial use; 8. Secure elements; 9. Hardware Security Modules (HSMs); 10. Secure cryptoprocessors; 11. Smartcards, smartcard readers and tokens; 12. Industrial Automation & Control Systems (IACS) intended for the use by essential entities of the type referred to in [Annex I to the Directive XXX/XXXX (NIS2)], such as programmable logic controllers (PLC), distributed control systems (DCS), computerised numeric controllers for machine tools (CNC) and supervisory control and data acquisition systems (SCADA); 13. Industrial Internet of Things devices intended for the use by essential entities of the type referred to in [Annex I to the Directive XXX/XXXX (NIS2)]; 14. Robot sensing and actuator components and robot controllers; 15. Smart meters.deleted

Amendment 532 #

Proposal for a regulation
Annex III – Part II – point 1

~~1. Operating systems for servers, desktops, and mobile devices;~~deleted

Amendment 533 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Annex III – Part II – point 4

4. Firewalls, Security Gateways, intrusion detection and/or prevention systems intended for industrial use;

Amendment 534 #

Proposal for a regulation
Annex III – Part II – point 4

4. Firewalls, security gateways, intrusion detection and/or prevention systems intended for industrial use;

Amendment 535 #

Proposal for a regulation
Annex III – Part II – point 5

~~5. General purpose microprocessors;~~deleted

Amendment 536 #

Proposal for a regulation
Annex III – Part II – point 6

~~6. Microprocessors intended for integration in programmable logic controllers and secure elements;~~deleted

Amendment 537 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Annex III – Part II – point 7

7. Routers, modems intended for the connection to the internet, ~~and~~ switches, and other network nodes that are necessary for the provision of the connectivity service, intended for industrial use;

Amendment 538 #

Proposal for a regulation
Annex III – Part II – point 7

Amendment 539 #

Matteo GAZZINI, Paolo BORCHIA, Isabella TOVAGLIERI, Elena LIZZI, Matteo ADINOLFI, Markus BUCHHEIT, Marie DAUCHY

Proposal for a regulation
Annex III – Part II – point 11

11. Smartcards, smartcard readers, biometric readers, and tokens;

Amendment 540 #

15a. Smart home products, including smart home servers and virtual assistants;

Amendment 541 #

Proposal for a regulation
Annex III – Part II – point 15 b (new)

15b. Smart security devices, including smart door locks, cameras and alarm systems;

Amendment 542 #

Proposal for a regulation
Annex III – Part II – point 15 c (new)

15c. Smart toys and similar devices likely to interact with children;

Amendment 543 #

Proposal for a regulation
Annex III – Part II – point 15 d (new)

15d. Personal health appliances and wearables.

Amendment 544 #

Proposal for a regulation
Annex V – paragraph 1 – point 2 – point a

Amendment 545 #

Proposal for a regulation
Annex V – paragraph 1 – point 2 – point b

(b) complete information and specifications of the vulnerability handling processes put in place by the manufacturer~~, including the software bill of materials, the~~ the manufacturer’s coordinated vulnerability disclosure policy, evidence of the provision of a contact address for the reporting of the vulnerabilities and a description of the technical solutions chosen for the secure distribution of updates;

Amendment 546 #